JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 81.26.130.147

81.26.130.147 was found in our database!

This IP was reported 79 times. Confidence of Abuse is 100%: ?

100%

ISP	Yuzhniy TELECOM ltd.
Usage Type	Fixed Line ISP
ASN	AS20895
Domain Name	ugtel.ru
Country	🇷🇺 Russian Federation
City	Krasnodar, Krasnodar Krai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 81.26.130.147

Whois 81.26.130.147

IP Abuse Reports for 81.26.130.147:

This IP address has been reported a total of 79 times from 27 distinct sources. 81.26.130.147 was first reported on May 26th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ecs.ge	2026-06-15 17:05:01 (3 hours ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇨🇭 4server	2026-06-14 10:17:51 (1 day ago)	[SunJun1412:17:47.5079632026][security2:error][pid1646801:tid1647323][client81.26.130.147:0]ModSecur ... show more [SunJun1412:17:47.5079632026][security2:error][pid1646801:tid1647323][client81.26.130.147:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"rssolution.ch\"][uri\"/\"][unique_id\"ai5_y9tHhAh1XWd420wXlAAAAFg\"] show less	Hacking Web App Attack
🇩🇪 sverson	2026-06-14 05:17:53 (1 day ago)	Abusive use detected / Unauthorized connection attempt	Hacking Brute-Force
🇪🇸 el-brujo	2026-06-14 03:22:21 (1 day ago)	Cloudflare WAF: Request Path: /admin/plugins/ckeditor/fm/connectors/php/upload.php Request Query: ?T ... show more Cloudflare WAF: Request Path: /admin/plugins/ckeditor/fm/connectors/php/upload.php Request Query: ?Type=Image Host: foro.elhacker.net userAgent: Mozilla/5.0 (Windows NT 5.1; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0 Action: log Source: firewallManaged ASN Description: "Yuzhniy TELECOM" ltd. Country: RU Method: POST Timestamp: 2026-06-14T03:22:21Z ruleId: 6179ae15870a4bb7b2d480d4843b323c. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇩🇪 ecs.ge	2026-06-13 03:59:29 (2 days ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇨🇭 chr70	2026-06-12 16:32:00 (3 days ago)	Scanning for vulnerabilities	Web App Attack
🇺🇸 nodepile	2026-06-12 09:08:52 (3 days ago)	Requests denied due to active blacklist hits (tenant=82 method=POST path=/customer/address_file/uplo ... show more Requests denied due to active blacklist hits (tenant=82 method=POST path=/customer/address_file/upload ua='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2716.73 Safari/537.36') show less	Web App Attack Exploited Host
🇨🇭 4server	2026-06-11 22:05:53 (3 days ago)	[FriJun1200:05:47.6657872026][security2:error][pid1111428:tid1111817][client81.26.130.147:0]ModSecur ... show more [FriJun1200:05:47.6657872026][security2:error][pid1111428:tid1111817][client81.26.130.147:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mio-ip.ch\"][uri\"/\"][unique_id\"aisxO0189tJCaE_NRbWU1AAAAMo\"] show less	Hacking Web App Attack
🇦🇹 wrohr	2026-06-11 16:40:00 (4 days ago)	hacking joomla mail spam	Email Spam Brute-Force Bad Web Bot
🇩🇪 sverson	2026-06-11 02:17:57 (4 days ago)	Abusive use detected / Unauthorized connection attempt	Hacking Brute-Force
🇺🇸 slay3r9903	2026-06-10 16:28:12 (5 days ago)	IP address blocked by Cloudflare security rules due to suspicious activity and security violations.	Hacking Bad Web Bot
🇩🇪 4server	2026-06-10 15:35:06 (5 days ago)	[WedJun1017:35:01.6884342026][security2:error][pid569873:tid569989][client81.26.130.147:0]ModSecurit ... show more [WedJun1017:35:01.6884342026][security2:error][pid569873:tid569989][client81.26.130.147:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"lacer.ch\"][uri\"/\"][unique_id\"aimEJXp0K1dJGcbOicDOUAAAAQU\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 ecs.ge	2026-06-10 11:34:13 (5 days ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇪🇸 el-brujo	2026-06-10 10:40:58 (5 days ago)	Cloudflare WAF: Request Path: /admin/plugins/ckeditor/fm/connectors/php/upload.php Request Query: ?T ... show more Cloudflare WAF: Request Path: /admin/plugins/ckeditor/fm/connectors/php/upload.php Request Query: ?Type=Image Host: foro.elhacker.net userAgent: Mozilla/5.0 (X11; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2931.72 Safari/537.36 Action: log Source: firewallManaged ASN Description: Yuzhniy TELECOM ltd. Country: RU Method: POST Timestamp: 2026-06-10T10:40:58Z ruleId: 6179ae15870a4bb7b2d480d4843b323c. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇮🇩 hermawan	2026-06-10 04:05:16 (5 days ago)	[Wed Jun 10 11:05:10.896836 2026] [security2:error] [pid 175667:tid 140281602004672] [client 81.26.1 ... show more [Wed Jun 10 11:05:10.896836 2026] [security2:error] [pid 175667:tid 140281602004672] [client 81.26.130.147:55718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "300" at REQUEST_HEADERS:Keep-Alive. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "348"] [id "440004"] [msg "Keep Alive Header"] [data "Matched Data: 300 found within REQUEST_HEADERS:Keep-Alive: 300 request_line = GET / HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "aijidhjXwzj5OwvbeDWX2QAAAEA"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[175702] [oKaSWR5BYv4] [aijidhjXwzj5OwvbeDWX2QAAAEA] keep_alive=[0] [2026-06-10 11:05:10.896842] [R:aijidhjXwzj5OwvbeDWX2QAAAEA] UA:'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2957.63 Safari/537.36' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,* ... show less	Email Spam Hacking

Showing 1 to 15 of 79 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 194.165.16.162

🇮🇳 103.191.235.178

🇳🇱 45.148.10.152

🇨🇳 171.220.244.134

🇺🇸 147.185.132.246

🇺🇸 147.185.132.108

🇺🇸 136.107.80.25

🇨🇳 115.190.188.197

🇺🇸 104.236.66.186

🇮🇳 103.130.91.86

🇳🇬 102.88.137.145

🇷🇴 141.98.83.240

🇺🇸 134.209.78.247

🇨🇳 120.43.48.250

🇨🇳 118.81.204.194

🇷🇴 80.94.92.177

🇺🇸 20.65.193.108

🇯🇵 8.221.141.152

🇺🇸 195.184.76.89

🇳🇱 192.178.118.155