AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User MogBox joined AbuseIPDB in October 2022 and has reported 55,411 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇰🇿 2a00:5da0:1000:1::2b07	16 Sep 2025	Web-based Attack: GET /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇨🇳 2408:8240:631:e5d0:1a03:73ff:fef4:d058	16 Sep 2025	Web-based Attack: GET /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇺🇸 35.237.254.83	16 Sep 2025	(RSRCTROLL) Vulnerability Trolling: HEAD /wp 35.237.254.83 (US/United States/83.254.237.35.bc.google ... show more (RSRCTROLL) Vulnerability Trolling: HEAD /wp 35.237.254.83 (US/United States/83.254.237.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.237.254.83 - - [16/Sep/2025:14:25:04 -0400] "HEAD /wp HTTP/2.0" 404 - "http://mogbox.net/wp" "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.56 Mobile Safari/537.36" show less	Hacking
🇺🇸 34.232.176.49	16 Sep 2025	Web-based Attack: GET /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇳🇱 196.251.70.47	16 Sep 2025	(mod_security) mod_security (id:210492) triggered by 196.251.70.47 (SC/Seychelles/-): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 196.251.70.47 (SC/Seychelles/-): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Sep 16 14:14:54.420917 2025] [security2:error] [pid 2350045:tid 2350048] [remote 196.251.70.47:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mogs.lol"] [uri "/.env"] [unique_id "aMmpHlzLCCP5xdfAqYIx8gAATgA"] show less	Hacking
🇷🇺 90.156.142.52	16 Sep 2025	Web-based Attack: GET /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇮🇳 15.206.85.226	16 Sep 2025	Web-based Attack: GET /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇫🇷 147.135.222.126	16 Sep 2025	Web-based Attack: GET /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇺🇸 43.130.74.193	16 Sep 2025	(mod_security) mod_security (id:210350) triggered by 43.130.74.193 (US/United States/-): 1 in the la ... show more (mod_security) mod_security (id:210350) triggered by 43.130.74.193 (US/United States/-): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Sep 16 13:24:35.431340 2025] [security2:error] [pid 2350045:tid 2350075] [client 43.130.74.193:38026] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|fitchugs.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fitchugs.com"] [uri "/"] [unique_id "aMmdU1zLCCP5xdfAqYIxagAAAEA"] show less	Hacking
🇺🇸 45.156.129.159	16 Sep 2025	(mod_security) mod_security (id:210730) triggered by 45.156.129.159 (PT/Portugal/sh-chi-us-gp6-wk125 ... show more (mod_security) mod_security (id:210730) triggered by 45.156.129.159 (PT/Portugal/sh-chi-us-gp6-wk125d.internet-census.org): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Sep 16 13:22:21.151251 2025] [security2:error] [pid 2350292:tid 2350335] [client 45.156.129.159:44213] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|209.59.154.179\|F\|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "209.59.154.179"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aMmczXBEGVW4mz9ZSaijCwAAABA"] show less	Hacking
🇻🇳 103.72.97.210	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇩🇪 185.197.195.89	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇳🇱 188.166.45.210	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇨🇳 129.28.14.231	16 Sep 2025	(mod_security) mod_security (id:210350) triggered by 129.28.14.231 (CN/China/-): 1 in the last 3600 ... show more (mod_security) mod_security (id:210350) triggered by 129.28.14.231 (CN/China/-): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Sep 16 12:42:02.935240 2025] [security2:error] [pid 2350292:tid 2350334] [client 129.28.14.231:46532] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|fitchugs.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fitchugs.com"] [uri "/"] [unique_id "aMmTWnBEGVW4mz9ZSaih8AAAAA8"] show less	Hacking
🇫🇷 2001:41d0:1008:13a4::	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇺🇸 170.106.35.187	16 Sep 2025	(mod_security) mod_security (id:210350) triggered by 170.106.35.187 (US/United States/-): 1 in the l ... show more (mod_security) mod_security (id:210350) triggered by 170.106.35.187 (US/United States/-): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Sep 16 12:35:01.957318 2025] [security2:error] [pid 2350292:tid 2350324] [client 170.106.35.187:46272] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.fitchugs.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fitchugs.com"] [uri "/"] [unique_id "aMmRtXBEGVW4mz9ZSaihvAAAAAU"] show less	Hacking
🇭🇰 218.255.64.242	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇫🇷 217.182.158.226	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇨🇳 8.137.149.112	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇺🇸 3.235.190.37	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇷🇺 90.156.142.52	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇨🇱 190.215.195.227	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇺🇸 162.243.62.9	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇩🇪 95.143.172.176	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇭🇰 198.44.187.31	16 Sep 2025	Web-based Attack: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack