This IP address has been reported a total of
13
times from
12 distinct
sources.
81.17.159.48 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Czechia
with 3
reports;
Germany
with 3
reports;
Netherlands
with 3
reports.
The most common categories in these recent reports were:
Web App Attack
8
times;
Hacking
7
times;
Brute-Force
6
times;
Bad Web Bot
2
times;
SQL Injection
1
time;
Other
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[MonOct1909:59:11.8944272026][security2:error][pid4161637:tid4161750][client81.17.159.48:0]ModSecuri ...
show more[MonOct1909:59:11.8944272026][security2:error][pid4161637:tid4161750][client81.17.159.48:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"salonesamire.ch\"][uri\"/\"][unique_id\"atXNzxIPGC_H1Kj8v8on0QAAANQ\"]
show less
Reason:15 (Hacking), Via: bomenrooien.com/index-ajax.php, Message: Blocked URL pattern: 'index- ...
show moreReason:15 (Hacking), Via: bomenrooien.com/index-ajax.php, Message: Blocked URL pattern: 'index-ajax.php'. [POST] Gevaarlijk woord 'EVAL' in Value in 'search' [+35]; Gevaarlijk woord 'eval' in Value in 'ucfg' [+35]; Verdachte string 'base64_decode' in Value in 'ucfg' [+20]; Verdachte Base64 content: [
show less
Automated credential attack against a legacy web authentication flow: 159 matching requests observed ...
show moreAutomated credential attack against a legacy web authentication flow: 159 matching requests observed between 2026-10-18T05:29:27+00:00 and 2026-10-18T18:31:42+00:00 UTC.
show less
Oct 15 11:31:07 canopus postfix/smtpd[760864]: NOQUEUE: reject: RCPT from unknown[81.17.159.48]: 554 ...
show moreOct 15 11:31:07 canopus postfix/smtpd[760864]: NOQUEUE: reject: RCPT from unknown[81.17.159.48]: 554 5.7.1 Service unavailable; Client host [81.17.159.48] blocked using zen.spamhaus.org; Listed by PBL, see https://check.spamhaus.org/query/ip/81.17.159.48 / Listed by XBL, see https://check.spamhaus.org/query/ip/81.17.159.48; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<31.76.11.151>
Oct 15 11:31:07 canopus postfix/smtpd[760864]: NOQUEUE: reject: RCPT from unknown[81.17.159.48]: 554 5.7.1 Service unavailable; Client host [81.17.159.48] blocked using zen.spamhaus.org; Listed by PBL, see https://check.spamhaus.org/query/ip/81.17.159.48 / Listed by XBL, see https://check.spamhaus.org/query/ip/81.17.159.48; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<31.76.11.151>
Oct 15 11:31:07 canopus postfix/smtpd[760864]: NOQUEUE: reject: RCPT from unknown[81.17.159.48]: 554 5.7.1 Service unavailable; Client host [81.17.159.48] blocked using zen.spamhau
...
show less
Brute-Force
Exploited Host
Anonymous
| [Dangerous/Russia] Aggressive IP 81.17.159.48 (~30 hits). Type: DoS Defender- Web server 400 error ...
show more| [Dangerous/Russia] Aggressive IP 81.17.159.48 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Web App Attack
Hacking
SQL Injection
Anonymous
IP matched detection query 20 more in short time bad rqs.
Port scan sweep against closed ports. Automated TCP SYN scan exceeding 15 packets per minute across ...
show morePort scan sweep against closed ports. Automated TCP SYN scan exceeding 15 packets per minute across closed ports; blocked by firewall. Target: TCP/6882. First seen: 2026-10-10 08:47:25 UTC. Source: host firewall/sshd log.
show less
Port Scan
Showing 1 to
13
of 13 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
