JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 87.120.126.166

87.120.126.166 was found in our database!

This IP was reported 144 times. Confidence of Abuse is 0%: ?

ISP	H2.NEXUS Frankfurt Network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS215730
Hostname(s)	s279069.love-is.nexus
Domain Name	h2.nexus
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 87.120.126.166

Whois 87.120.126.166

IP Abuse Reports for 87.120.126.166:

This IP address has been reported a total of 144 times from 15 distinct sources. 87.120.126.166 was first reported on October 8th 2024, and the most recent report was 11 months ago.

Old Reports: The most recent abuse report for this IP address is from 11 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-07-15 10:47:45 (11 months ago)	ModSecurity IDs: 920440,949110,980130; manually confirmed	Brute-Force
🇸🇪 SkyDancer	2025-07-10 18:34:03 (11 months ago)	Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by ... show more Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-5 show less	Hacking Brute-Force SSH
🇮🇹 Progetto1	2025-07-10 15:29:02 (11 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 ipblock.com	2025-07-10 12:50:00 (11 months ago)	IPBlock protected site ID [669-fx]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇦🇺 Block Rockin' Beats	2025-07-10 12:31:05 (11 months ago)	Scanning for exploitable scripts	Hacking Web App Attack
🇺🇸 kosada.com	2025-07-10 12:17:06 (11 months ago)	Web vulnerability probing	Web App Attack
🇩🇪 conseilgouz	2025-07-10 11:29:55 (11 months ago)	ece-Security key failure	Hacking
🇺🇸 TPI-Abuse	2025-07-10 09:31:34 (11 months ago)	(mod_security) mod_security (id:210730) triggered by 87.120.126.166 (s154626.love-is.nexus): 1 in th ... show more (mod_security) mod_security (id:210730) triggered by 87.120.126.166 (s154626.love-is.nexus): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 10 05:31:26.073087 2025] [security2:error] [pid 27417:tid 27417] [client 87.120.126.166:48820] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|danged.com\|F\|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "danged.com"] [uri "/elmah.axd"] [unique_id "aG-IbuTEMicZJltklpm-tQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-07-10 08:59:02 (11 months ago)	Malicious activity detected	Hacking Web App Attack
🇩🇪 conseilgouz	2025-07-10 08:34:15 (11 months ago)	coe-22 : 8G : REQUEST_URI error=>/elmah.axd	Hacking
🇩🇪 Carsten	2025-07-10 07:49:43 (11 months ago)	GET [elmah.axd]	Port Scan
🇮🇩 Burayot	2025-07-10 06:12:10 (11 months ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 87.120.126.166 (DE/Germany/s154626.l ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 87.120.126.166 (DE/Germany/s154626.love-is.nexus): 1 in the last 3600 secs show less	Web App Attack
🇺🇸 TPI-Abuse	2025-07-10 05:17:27 (11 months ago)	(mod_security) mod_security (id:210730) triggered by 87.120.126.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 87.120.126.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 10 01:17:21.363610 2025] [security2:error] [pid 17713:tid 17713] [client 87.120.126.166:43674] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bladesoflegend.com\|F\|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bladesoflegend.com"] [uri "/elmah.axd"] [unique_id "aG9M4WrI7rJ0Ni_NFNF4kwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-07-10 05:00:31 (11 months ago)	(mod_security) mod_security (id:210730) triggered by 87.120.126.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 87.120.126.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 10 01:00:26.429246 2025] [security2:error] [pid 29844:tid 29844] [client 87.120.126.166:13410] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bigheartskitchen.com\|F\|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bigheartskitchen.com"] [uri "/elmah.axd"] [unique_id "aG9I6hp0VJ2cnbB3xMaOZAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-07-10 04:22:58 (11 months ago)	(mod_security) mod_security (id:210730) triggered by 87.120.126.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 87.120.126.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 10 00:22:54.951850 2025] [security2:error] [pid 8005:tid 8005] [client 87.120.126.166:40158] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|basselier.com\|F\|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "basselier.com"] [uri "/elmah.axd"] [unique_id "aG9AHoKsRJZYhEhlz7CycQAAACE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a03:2880:f814:42::

🇹🇼 221.120.78.177

🇰🇷 211.186.115.35

🇨🇳 180.76.105.165

🇵🇱 178.219.100.201

🇺🇸 172.234.25.187

🇨🇳 120.48.178.72

🇸🇮 102.220.160.176

🇳🇱 91.92.40.10

🇺🇸 45.55.139.45

🇬🇧 35.246.80.146

🇺🇸 162.216.149.120

🇧🇩 103.25.250.246

🇦🇲 91.103.248.222

🇺🇸 64.62.156.165

🇱🇹 62.60.130.223

🇮🇶 37.238.67.20

🇺🇸 205.210.31.33

🇧🇷 191.53.14.47

🇦🇷 186.123.212.59