JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 82.165.81.197

82.165.81.197 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 46%: ?

46%

ISP	IONOS SE
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8560
Hostname(s)	infong-eu97.clienthosting.eu
Domain Name	ionos.com
Country	🇩🇪 Germany
City	Karlsruhe, Baden-Wurttemberg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 82.165.81.197

Whois 82.165.81.197

IP Abuse Reports for 82.165.81.197:

This IP address has been reported a total of 20 times from 15 distinct sources. 82.165.81.197 was first reported on January 20th 2021, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 ptlab	2026-08-27 08:45:05 (1 day ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
Anonymous	2026-08-27 08:25:13 (1 day ago)	Network service scanning detected by FortiGate; source quarantined.	Port Scan
🇺🇸 TPI-Abuse	2026-08-26 09:22:22 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 82.165.81.197 (infong-eu97.clienthosting.eu): 1 ... show more (mod_security) mod_security (id:225170) triggered by 82.165.81.197 (infong-eu97.clienthosting.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 05:22:18.050670 2026] [security2:error] [pid 21639:tid 21658] [client 82.165.81.197:34228] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|guitarprimer.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "guitarprimer.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ao6wSkmEBRv4GEcjX9w7dwAAAUU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-08-26 08:28:03 (2 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
Anonymous	2026-08-26 08:14:29 (2 days ago)	Web application attack detected.	Web App Attack
🇺🇸 cwytech	2026-08-25 06:18:35 (3 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.	Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-08-19 04:38:03 (1 week ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇲🇹 Malta	2026-05-25 07:58:21 (3 months ago)	82.165.81.197 - - [25/May/2026:09:58:21 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubun ... show more 82.165.81.197 - - [25/May/2026:09:58:21 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇩🇪 Hazzard	2026-03-22 12:21:16 (5 months ago)	(wordpress) Failed wordpress login from 82.165.81.197 (DE/Germany/-/-/infong-eu97.clienthosting.eu/[ ... show more (wordpress) Failed wordpress login from 82.165.81.197 (DE/Germany/-/-/infong-eu97.clienthosting.eu/[redacted]): (CF_ENABLE) show less	Brute-Force
Anonymous	2026-01-26 03:54:14 (7 months ago)	[redacted] 82.165.81.197 - - [26/Jan/2026:04:54:13 +0100] "POST /xmlrpc.php HTTP/2.0" 403 199 "-" "M ... show more [redacted] 82.165.81.197 - - [26/Jan/2026:04:54:13 +0100] "POST /xmlrpc.php HTTP/2.0" 403 199 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" [redacted] 82.165.81.197 - - [26/Jan/2026:04:54:13 +0100] "POST /xmlrpc.php HTTP/2.0" 403 199 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" [redacted] 82.165.81.197 - - [26/Jan/2026:04:54:13 +0100] "POST /xmlrpc.php HTTP/2.0" 403 199 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" [redacted] 82.165.81.197 - - [26/Jan/2026:04:54:13 +0100] "POST /xmlrpc.php HTTP/2.0" 403 199 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win ... show less	Hacking Web App Attack
🇩🇪 big-cloud.nl	2026-01-20 04:44:05 (7 months ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 myagent.site	2026-01-02 23:44:48 (7 months ago)	Blocking for trying to access an exploit file: /xmlrpc.php	Hacking
🇺🇸 myagent.site	2026-01-01 09:10:37 (7 months ago)	Blocking for trying to access an exploit file: /xmlrpc.php	Hacking
🇺🇸 octageeks.com	2025-12-31 05:06:12 (7 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇺🇸 TPI-Abuse	2025-12-12 00:06:55 (8 months ago)	(mod_security) mod_security (id:225170) triggered by 82.165.81.197 (infong-eu97.clienthosting.eu): 1 ... show more (mod_security) mod_security (id:225170) triggered by 82.165.81.197 (infong-eu97.clienthosting.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 11 19:06:52.181616 2025] [security2:error] [pid 29165:tid 29165] [client 82.165.81.197:45534] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.somehand.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.somehand.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTtcnEGNRuhRIF8EXhJm7AAAACU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.141

🇫🇷 172.71.119.99

🇨🇳 123.245.84.138

🇨🇳 222.176.200.220

🇹🇼 198.235.24.95

🇬🇧 194.50.235.141

🇬🇧 193.176.29.13

🇨🇳 120.24.249.224

🇧🇷 108.179.193.50

🇧🇬 79.124.59.186

🇱🇹 62.60.130.201

🇸🇬 47.82.55.149

🇬🇧 31.14.254.11

🇬🇧 5.226.140.31

🇬🇧 2.57.17.244

🇲🇽 201.137.37.131

🇧🇪 198.235.24.237

🇺🇸 184.105.139.85

🇮🇩 182.253.152.49

🇺🇸 172.169.235.135