JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

80.96.112.119

Recent Activity

Abuse confidence score ?

100% Critical

29 reports

25 reporters · latest 33 minutes ago

ISP	AlexHost SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200019
Hostname(s)	10144.com
Domain Name	alexhost.com
Country	🇷🇴 Romania
City	Bucharest, Bucharest

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 80.96.112.119

Export CSV

This IP address has been reported a total of 29 times from 25 distinct sources. 80.96.112.119 was first reported on October 19th 2026, and the most recent report was 33 minutes ago. In the last 60 days, the top reporter locations were: Germany with 6 reports; United States of America with 5 reports; Switzerland with 3 reports. The most common categories in these recent reports were: Web App Attack 24 times; Hacking 12 times; Brute-Force 4 times; Bad Web Bot 4 times; Port Scan 2 times; Other 2 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-10-25 08:26:58 (33 minutes ago)	Repeated requests for suspicious nonexistent URLs, for example: /test.php?%ADd%20cgi.force_redirect% ... show more Repeated requests for suspicious nonexistent URLs, for example: /test.php?%ADd%20cgi.force_redirect%3D0%20%ADd%20cgi.redirect_status_env%20%ADd%20allow_url_include%3D1%20%ADd%20auto_prepend_file%3Dphp%3A%2F%2Finput= (HTTP port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.1501.12 Safari/537.36") show less	Web App Attack
🇩🇪 SCHAPPY	2026-10-24 16:39:06 (16 hours ago)	Critical web app attack detected. PHP Injection Attack: Configuration Directive Found	Web App Attack
🇹🇷 muratkaya665	2026-10-24 12:26:37 (20 hours ago)	IPS Attack Blocked by server.mura****.com.tr Fortigate-80E. Attack Name: PHP.CGI.Argument.Injectio ... show more IPS Attack Blocked by server.mura****.com.tr Fortigate-80E. Attack Name: PHP.CGI.Argument.Injection. Dest Port: 80. Service: HTTP. Message: web_server: PHP.CGI.Argument.Injection. show less	Hacking
🇩🇪 LRob	2026-10-24 03:45:37 (1 day ago)	Vulnerability scanning \| host: acpromogroup.com \| method: POST \| path: /php-cgi/php-cgi.exe, /index. ... show more Vulnerability scanning \| host: acpromogroup.com \| method: POST \| path: /php-cgi/php-cgi.exe, /index.php, /test.php (+1 more) \| ua: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.1368.60 Safari/537.36 \| src_port: 52220 \| 2026-10-24 03:45 UTC show less	Port Scan Web App Attack
🇩🇪 BlueWire Hosting	2026-10-23 17:54:04 (1 day ago)	Aggressive scanning resulting into 404	Bad Web Bot
🇬🇧 consul.to	2026-10-23 17:14:10 (1 day ago)	Web attack/malicious scanning detected	Web App Attack
🇨🇦 john doe	2026-10-23 14:42:28 (1 day ago)	SentinelBot: PHP Exploit (score: 76)	Web App Attack
🇨🇳 800bus.cn	2026-10-23 10:00:09 (1 day ago)	Blocked by BT-WAF. Rule: PHP代码执行	Web App Attack Hacking
🇳🇱 e.fierstra	2026-10-23 08:55:08 (2 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-10-23 08:44:26 (2 days ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possi ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /[a-z0-9]{1,12}\.php (Match: /test.php) show less	Hacking Exploited Host Web App Attack
🇨🇭 4server	2026-10-23 07:34:51 (2 days ago)	[FriOct2309:34:45.2694132026][security2:error][pid1573638:tid1573736][client80.96.112.119:0]ModSecur ... show more [FriOct2309:34:45.2694132026][security2:error][pid1573638:tid1573736][client80.96.112.119:0]ModSecurity:Accessdeniedwithcode403$phase2$.Matchof\"rx\^0\$\"against\"REQUEST_HEADERS:Content-Length\"required.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"88\"][id\"392301\"][rev\"8\"][msg\"Atomicorp.comWAFRules:RequestContainingContent\,butMissingContent-Typeheader\"][severity\"NOTICE\"][tag\"no_ar\"][hostname\"aid-consultancy.com\"][uri\"/php-cgi/php-cgi.exe\"][unique_id\"atsOFWVPjoS7OyQrEY690QAAAQo\"] show less	Hacking Web App Attack
🇳🇱 Mangelot Hosting	2026-10-23 04:22:21 (2 days ago)	(web_lfi) srv101 Path traversal / file inclusion attempt 80.96.112.119 (RO/Romania/10144.com): 2 in ... show more (web_lfi) srv101 Path traversal / file inclusion attempt 80.96.112.119 (RO/Romania/10144.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇸🇬 securejdprop	2026-10-23 02:58:17 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/vpatch-CVE-2024-4577.	Hacking
🇨🇦 AEITS	2026-10-23 01:42:39 (2 days ago)	Fail2Ban www	Bad Web Bot Web App Attack
Anonymous	2026-10-22 23:39:20 (2 days ago)	Web scanner: GET /test.php?%ADd+cgi.force_redirect%3D0+%ADd+cgi.redirect_status_env+%ADd+allow_url_i ... show more Web scanner: GET /test.php?%ADd+cgi.force_redirect%3D0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input show less	Web App Attack Hacking

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 183.247.171.186

🇺🇸 199.165.159.196

🇹🇯 185.105.228.105

🇺🇸 184.154.245.42

🇮🇳 152.59.36.74

🇫🇮 147.185.133.16

🇺🇸 147.185.132.216

🇮🇳 140.245.12.112

🇺🇸 134.209.68.177

🇺🇸 129.121.101.166

🇵🇭 124.217.47.7

🇧🇩 103.190.205.217

🇮🇳 103.70.40.36

🇷🇺 88.84.209.146

🇩🇪 80.97.45.140

🇵🇱 80.49.161.239

🇬🇧 77.67.26.239

🇩🇪 69.5.169.126

🇩🇪 69.5.169.18

🇺🇸 54.225.148.123