JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.220.41.18

91.220.41.18 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 39%: ?

39%

ISP	Iraq Al-wataniyah Co. for Telecom Services Ltd.
Usage Type	Fixed Line ISP
ASN	AS200200
Domain Name	fiberx.iq
Country	🇮🇶 Iraq
City	Basrah, Basra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.220.41.18

Whois 91.220.41.18

IP Abuse Reports for 91.220.41.18:

This IP address has been reported a total of 28 times from 19 distinct sources. 91.220.41.18 was first reported on June 21st 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-10-20 04:14:41 (3 days ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇦🇺 FireGuard Server	2026-10-19 23:50:06 (3 days ago)	Blocked by os-abuseipdb; 5 hits, proto=tcp, ports=443	Port Scan Hacking
🇷🇺 AbuseIPDB informer	2026-10-15 18:54:08 (1 week ago)	nfdump top talker: 91.220.41.18 \| first seen 2026-10-15 21:54:08 \| duration 339.968s \| flows=182 \| p ... show more nfdump top talker: 91.220.41.18 \| first seen 2026-10-15 21:54:08 \| duration 339.968s \| flows=182 \| packets=479787 \| bytes=637157136 \| pps=1411 \| bps=14993343 \| bpp=1328 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇫🇷 masterguru	2026-10-13 08:46:47 (1 week ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 91.220.41.18 (IQ/Iraq/-): 1 in the last 3600 ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 91.220.41.18 (IQ/Iraq/-): 1 in the last 3600 secs (0-196) show less	Hacking
🇺🇸 kosada.com	2026-10-01 20:23:53 (3 weeks ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=61&topics%5B4%5D=51&topics%5B5%5D=56&topics%5B6%5D=67 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-09-24 22:39:18 (4 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-17 02:07:49 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 91.220.41.18 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 91.220.41.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:07:44.590330 2026] [security2:error] [pid 22071:tid 22071] [client 91.220.41.18:37334] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|rcjav.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcjav.com"] [uri "/"] [unique_id "aqtLcPBiJRiSszQUuNneqgAAABU"], referer: https://dapabacklinkchecker.website/dir/white-hat-link-building-172765 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-14 17:56:12 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇬🇪 ORDUNET	2026-09-09 15:00:05 (1 month ago)	Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:5555/udp in AS203136 (LLC Ordu ... show more Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:5555/udp in AS203136 (LLC Ordunet), Georgia, 2026-09-08/09 (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 200 packets/sec for a legitimate player of that server. It was one of 2743 sources in 1270 networks and 136 countries in the same period, the majority of which flooded udp/47472 where no service listens at all. Detected on a MikroTik RouterOS router in the raw/prerouting chain (dst-limit 800,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - a packet flood, so the host is most likely compromised. Evidence: [email protected]. show less	DDoS Attack Exploited Host
🇺🇸 鬼影233	2026-08-31 22:44:36 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-24 22:48:26 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-08-20 14:37:57 (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 MPL	2026-08-13 17:31:14 (2 months ago)	tcp ports: 23,22 (8 or more attempts)	Port Scan
🇩🇪 LRob	2026-08-06 16:00:55 (2 months ago)	CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'T ... show more CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS \| req: /calendrier-2/action~agenda/cat_ids~151,131,828/tag_ids~597,466,404,607,448,399/request_format~json/ \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	DDoS Attack Web App Attack
🇺🇸 kosada.com	2026-07-31 07:02:18 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 203.161.38.233

🇺🇸 165.154.235.9

🇳🇿 219.88.68.146

🇧🇩 202.86.218.135

🇺🇸 195.184.76.141

🇫🇷 194.164.217.191

🇳🇱 193.176.31.231

🇹🇷 185.250.240.124

🇺🇸 184.57.39.170

🇨🇴 181.143.49.238

🇺🇸 172.190.100.10

🇸🇪 171.25.158.171

🇸🇬 165.154.200.214

🇦🇿 158.181.41.201

🇫🇮 147.185.133.93

🇨🇳 106.13.46.138

🇮🇳 103.248.120.6

🇮🇩 103.113.170.231

🇧🇫 102.214.67.171

🇩🇪 91.92.43.221