JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.112.57.174

64.112.57.174 was found in our database!

This IP was reported 42 times. Confidence of Abuse is 56%: ?

56%

ISP	Nexus Bytes LLC
Usage Type	Fixed Line ISP
ASN	AS6079
Domain Name	nexusbytes.com
Country	🇺🇸 United States of America
City	Leesburg, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.112.57.174

Whois 64.112.57.174

IP Abuse Reports for 64.112.57.174:

This IP address has been reported a total of 42 times from 23 distinct sources. 64.112.57.174 was first reported on July 8th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-04 06:26:42 (2 weeks ago)	(mod_security) mod_security (id:212750) triggered by 64.112.57.174 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:212750) triggered by 64.112.57.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 04 02:25:56.932361 2026] [security2:error] [pid 1357675:tid 1357675] [client 64.112.57.174:36649] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|www.powerkiteforum.com\|F\|2"] [data "Matched Data: onload= found within REQUEST_URI: /member.php?action=viewpro&member=nomadic\\x22><svg onload=alert(qsxss9k7z)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.powerkiteforum.com"] [uri "/member.php"] [unique_id "anGF9DK_PDWSCEqXFi3SxQAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-03 22:44:20 (2 weeks ago)	(mod_security) mod_security (id:212750) triggered by 64.112.57.174 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:212750) triggered by 64.112.57.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 18:44:01.859562 2026] [security2:error] [pid 1193162:tid 1193162] [client 64.112.57.174:44613] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|www.bassboatmagazine.com\|F\|2"] [data "Matched Data: onload= found within REQUEST_URI: /advertisebbm/gotourl.php?id=5\\x22><svg onload=alert(qsxss9k7z)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.bassboatmagazine.com"] [uri "/advertiseBBM/gotourl.php"] [unique_id "anEZscUdqSvl4hF0TjI1_QAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-03 18:28:10 (2 weeks ago)	(mod_security) mod_security (id:212620) triggered by 64.112.57.174 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:212620) triggered by 64.112.57.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 14:27:39.760318 2026] [security2:error] [pid 577182:tid 577182] [client 64.112.57.174:48935] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|3905ccn.org\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /ncscalendar.php?year=2025&action=go&month=01&band=[all]&mode=[all]'\\x22></title></style></textarea></script><script>alert(qsxss9k7z)</script>&ncscallsign=[all]"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "3905ccn.org"] [uri "/ncsCalendar.php"] [unique_id "anDdmzwYlabCU2h2YFv3dAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 conseilgouz	2026-08-03 18:17:30 (2 weeks ago)	sae-6 : Trying access system files=>/index.php?option=com_content&view=article&id=114'& ... show more sae-6 : Trying access system files=>/index.php?option=com_content&view=article&id=114'&Itemid=560(htaccessphp) show less	Hacking
Anonymous	2026-08-03 17:35:10 (2 weeks ago)	suspicious request in access.log	Web App Attack
🇬🇧 Oakley	2026-08-03 15:01:08 (2 weeks ago)	(confirmed_bot_sig) Confirmed bot	Hacking
🇺🇸 Matthew Ping	2026-08-01 14:45:12 (2 weeks ago)	ModSecurity rule 949110 triggered on d865. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇱🇺 conseilgouz	2026-07-28 09:59:58 (3 weeks ago)	are-12 : Block return, carriage return, ... characters=>/media/tarteaucitron/tarteaucitron.js?05baba ... show more are-12 : Block return, carriage return, ... characters=>/media/tarteaucitron/tarteaucitron.js?05baba='(') show less	Hacking
🇩🇪 Reinhard	2026-07-26 15:25:05 (3 weeks ago)	Unknown activity, but too many attacks with too many users.	Hacking
🇺🇸 ipblock.com	2026-07-26 03:13:00 (3 weeks ago)	IPBlock protected site ID [4730-fr]. Exploit request, vulnerability probe.	Hacking Bad Web Bot Web App Attack
🇩🇪 raph	2026-07-22 14:50:29 (4 weeks ago)	[001] honeypot form submission	Web Spam Blog Spam
🇺🇸 ipblock.com	2026-07-17 10:03:00 (1 month ago)	IPBlock protected site ID [4055-d][s=06]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇺🇸 TheJimmo	2026-07-16 13:46:52 (1 month ago)	64.112.57.174 64.112.57.174 - - [16/Jul/2026:13:45:42 +0000] "GET /cgi-bin/cgiServer.exx%3Fdownload= ... show more 64.112.57.174 64.112.57.174 - - [16/Jul/2026:13:45:42 +0000] "GET /cgi-bin/cgiServer.exx%3Fdownload=/etc/passwd HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" 64.112.57.174 64.112.57.174 - - [16/Jul/2026:13:45:36 +0000] "POST /wp-login.php HTTP/1.1" 404 13353 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" 64.112.57.174 64.112.57.174 - - [16/Jul/2026:13:45:39 +0000] "GET /web.config.i18n.ashx?l=trihh&v=trihh HTTP/1.1" 404 13394 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" 64.112.57.174 64.112.57.174 - - [16/Jul/2026:13:45:43 +0000] "GET /login.html HTTP/1.1" 404 13349 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" 64.112.57.174 64.112.57.174 - - [16/Jul/2026:13:45: ... show less	Bad Web Bot Web App Attack
🇬🇧 SilverZippo	2026-07-15 21:54:55 (1 month ago)	Web App Attack	Web App Attack
🇩🇪 FeG Deutschland	2026-07-15 21:21:44 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.47.62.69

🇳🇱 91.92.40.43

🇩🇪 69.5.169.147

🇺🇸 65.49.1.181

🇳🇱 45.148.10.157

🇵🇰 39.40.41.27

🇮🇱 38.253.103.78

🇺🇸 207.90.244.26

🇨🇴 181.78.9.202

🇦🇷 181.45.51.70

🇧🇷 177.194.202.60

🇰🇷 121.165.61.178

🇹🇷 78.174.67.66

🇯🇵 72.63.109.0

🇸🇬 68.183.236.1

🇱🇹 62.60.130.234

🇹🇼 198.235.24.117

🇳🇱 195.178.110.232

🇨🇳 183.26.113.197

🇨🇴 181.225.83.91