JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

83.97.119.154

Recent Activity

Abuse Confidence Score

19% Caution

14 reports

11 reporters · latest 1 hour ago

ISP: FINE GROUP SERVERS SOLUTIONS LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS46475
Domain Name: finegroupservers.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

14 from 11 distinct reporters

First reported

May 31st 2024

Most recent report

1 hour ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 4 🇩🇪 Germany 1

Most common categories Web App Attack 4 Bad Web Bot 4 Brute-Force 3 Hacking 1 Exploited Host 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-11-13 09:47:52 UTC · (1 hour ago)	(mod_security) mod_security (id:210350) triggered by 83.97.119.154 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:47:47.577363 2026] [security2:error] [pid 7063:tid 7063] [client 83.97.119.154:32043] Mod ... show more (mod_security) mod_security (id:210350) triggered by 83.97.119.154 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:47:47.577363 2026] [security2:error] [pid 7063:tid 7063] [client 83.97.119.154:32043] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.whodatnation.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.whodatnation.com"] [uri "/2010/10/31/rapid-reaction-saints-20-steelers-10/"] [unique_id "avbcww3437XCEnCX0bW33wAAAHU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-08 18:59:01 UTC · (4 days ago)	(mod_security) mod_security (id:210350) triggered by 83.97.119.154 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:58:57.295910 2026] [security2:error] [pid 2785:tid 2785] [client 83.97.119.154:60455] Mod ... show more (mod_security) mod_security (id:210350) triggered by 83.97.119.154 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:58:57.295910 2026] [security2:error] [pid 2785:tid 2785] [client 83.97.119.154:60455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|alexlacruz.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "alexlacruz.com"] [uri "/lou-doillon-for-equipment-17.html"] [unique_id "avDGcaQmUbDiGbHSXqDAlQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Zandro	2026-10-30 13:00:14 UTC · (1 week ago)	distributed harvester	DDoS Attack Bad Web Bot Exploited Host
🇺🇸 TPI-Abuse	2026-10-27 21:50:53 UTC · (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 83.97.119.154 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:50:46.468051 2026] [security2:error] [pid 11729:tid 11729] [client 83.97.119.154:57185] M ... show more (mod_security) mod_security (id:210350) triggered by 83.97.119.154 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:50:46.468051 2026] [security2:error] [pid 11729:tid 11729] [client 83.97.119.154:57185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.mathieu.bouville.name\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mathieu.bouville.name"] [uri "/billiards/billiards.html"] [unique_id "auEctu80MMrSR7IkLIX4FAAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-10-12 04:41:16 UTC · (1 month ago)	Web exploit attempt \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36	Hacking Web App Attack
Anonymous	2026-08-20 19:37:47 UTC · (2 months ago)	VPN portal credential brute-force / password spray against a SAML-only GlobalProtect portal (2 attempt(s) observed, 2 username(s) tried). Source blocked on our perimeter.	Brute-Force
Anonymous	2026-08-20 05:57:50 UTC · (2 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇫🇮 JimArchon72	2026-07-05 06:05:03 UTC · (4 months ago)	2026/07/05 06:01:30 "GET /wp-login.php?action=register HTTP/1.1"	Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-09-24 11:17:24 UTC · (1 year ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇨🇿 lp	2024-11-25 15:02:46 UTC · (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 83.97.119.154 2024-11-25T15:38:37+01:00 vpn Access-Reject 'pc43' station: 83.97.119.154 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'	Brute-Force Web App Attack
🇫🇷 www.unitiz.com	2024-08-10 14:39:15 UTC · (2 years ago)	Probing non-existent URLs	Bad Web Bot Web App Attack
🇦🇺 afleventoffice.com.au	2024-08-04 13:54:01 UTC · (2 years ago)		Web App Attack
🇩🇪 NxtGenIT	2024-06-03 15:49:30 UTC · (2 years ago)	83.97.119.154 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt	Brute-Force
🇩🇪 NxtGenIT	2024-05-31 15:48:52 UTC · (2 years ago)	83.97.119.154 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt	Brute-Force

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇱 2400:cb00:923:1000:602b:8ef6:8be7:de07

🇰🇷 220.126.237.110

🇫🇷 207.180.192.232

🇮🇳 203.145.165.2

🇳🇱 86.38.187.69

🇬🇧 35.203.210.33

🇹🇷 31.58.250.114

🇵🇱 2400:cb00:923:1000:dc32:5b3d:fe4c:30ef

🇳🇱 109.160.32.176

🇫🇮 80.223.201.173

🇬🇧 35.203.211.225

🇻🇪 200.35.109.130

🇩🇪 172.70.248.119

🇩🇪 172.70.248.118

🇺🇸 146.190.74.75

🇨🇳 106.75.31.194

🇺🇸 65.35.219.169

🇳🇱 45.148.10.157

🇷🇴 2.57.122.150

🇵🇹 109.49.219.99