AbuseIPDB » 89.46.105.196

89.46.105.196 was found in our database!

This IP was reported 227 times. Confidence of Abuse is 92%: ?

92%

ISP	Aruba S.p.A. - Shared Hosting IT1
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31034
Hostname(s)	host196-105-46-89.serverdedicati.aruba.it
Domain Name	aruba.it
Country	Italy
City	Arezzo, Tuscany

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 89.46.105.196

Whois 89.46.105.196

IP Abuse Reports for 89.46.105.196:

This IP address has been reported a total of 227 times from 58 distinct sources. 89.46.105.196 was first reported on January 12th 2021, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
hbrks	2025-05-12 14:12:31 (13 hours ago)	GET http://marche-be.com/wp-config.php.backup	Web Spam Hacking Bad Web Bot
TPI-Abuse	2025-05-10 13:08:54 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati ... show more(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 10 09:08:47.179678 2025] [security2:error] [pid 2138637:tid 2138637] [client 89.46.105.196:27340] [client 89.46.105.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "montebiancoltd.com"] [uri "/wp-config.php~"] [unique_id "aB9P36tVK_-uK-ZL2g27NgAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
bescared	2025-05-09 19:25:53 (3 days ago)	F2B - Malicious activity detected. URL Probing.	Hacking Bad Web Bot Web App Attack
Anonymous	2025-05-09 14:30:33 (3 days ago)	Malicious activity detected	Hacking Web App Attack
nationaleventpros.com	2025-05-09 12:56:06 (3 days ago)	vulnerability scan	Web App Attack
yukon.ca	2025-05-08 15:16:16 (4 days ago)	WordPress Enforcement Protection: WordPress Sensitive System Files Information Disclosure Port ... show moreWordPress Enforcement Protection: WordPress Sensitive System Files Information Disclosure Port:80 show less	Hacking Exploited Host
TPI-Abuse	2025-05-08 09:39:17 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati ... show more(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 08 05:39:12.397746 2025] [security2:error] [pid 3516462:tid 3516462] [client 89.46.105.196:37174] [client 89.46.105.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "termstech.com"] [uri "/wp-config.php~"] [unique_id "aBx7wJjEB4vLgkqWIFnrRwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
advena	2025-05-08 01:30:55 (5 days ago)	89.46.105.196 (AS31034 ARUBA-ASN) was intercepted at 2025-05-08T01:24:16Z after violating WAF direct ... show more89.46.105.196 (AS31034 ARUBA-ASN) was intercepted at 2025-05-08T01:24:16Z after violating WAF directive: 9ce4e284ff2a486aaa37d642bff5a079. Pre-cautionary/corrective action applied: block. show less	Web Spam Hacking Brute-Force Web App Attack
TPI-Abuse	2025-05-07 04:26:32 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati ... show more(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 07 00:26:24.997750 2025] [security2:error] [pid 1859957:tid 1859957] [client 89.46.105.196:24782] [client 89.46.105.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lejzerowicz.org"] [uri "/wp-config.php_"] [unique_id "aBrg8EL-yqu2gS7DZA1lpAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
ipblock.com	2025-05-07 00:17:00 (6 days ago)	IPBlock protected site ID [4055-d][s=07]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
TPI-Abuse	2025-05-06 10:05:27 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati ... show more(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 06 06:05:23.417713 2025] [security2:error] [pid 503484:tid 503484] [client 89.46.105.196:25950] [client 89.46.105.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "magusniche.com"] [uri "/wp-config.php_bak"] [unique_id "aBne46fux5YPcUzZJoQbrAAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
ipblock.com	2025-05-05 08:31:00 (1 week ago)	IPBlock protected site ID [4055-d][s=02]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
IRISIO	2025-05-05 08:19:31 (1 week ago)	scans/SQL injection/spam posts : 2 queries	SQL Injection Web App Attack
TPI-Abuse	2025-05-05 06:39:26 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati ... show more(mod_security) mod_security (id:210492) triggered by 89.46.105.196 (host196-105-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 05 02:39:20.423327 2025] [security2:error] [pid 671355:tid 671355] [client 89.46.105.196:35832] [client 89.46.105.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hpepaper.com"] [uri "/wp-config.php-old"] [unique_id "aBhdGD_zH8PKmaM1i5JR7wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
ipblock.com	2025-05-05 05:57:00 (1 week ago)	IPBlock protected site ID [4055-d][s=08]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩