Total reports
5 from
4 distinct
reporters
First reported
November 17th 2023
Most recent report
5 days ago
Last 60 days
Top reporter locations
🇩🇪
Germany
1
Most common categories
Web App Attack
1
Hacking
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
heyzg
2026-11-07 09:53:17
UTC ·
(5 days ago)
LLM Inference API Requests (Ollama) (observed): 4 HTTP, 5s
Hacking
Web App Attack
2023-11-30 14:55:02
UTC ·
(2 years ago)
| Multiple SQL injection attempts from same source ip.(multiple servers)
Hacking
SQL Injection
Web App Attack
🇮🇹
IRT@Unisi
2023-11-27 02:01:25
UTC ·
(2 years ago)
web_app3:WordPress.Site.Editor.Plugin.File.Disclosure
Web App Attack
🇺🇸
TPI-Abuse
2023-11-23 05:08:20
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 104.28.251.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 23 00:08:12.702164 2023] [security2:error] [pid 7970] [client 104.28.251.52:40449] [client 104. ...
show more
(mod_security) mod_security (id:210730) triggered by 104.28.251.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 23 00:08:12.702164 2023] [security2:error] [pid 7970] [client 104.28.251.52:40449] [client 104.28.251.52] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cosplayculture.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cosplayculture.com"] [uri "/base_import/static/c:/windows/win.ini"] [unique_id "ZV7ePHPNEb-tdi26aKFyFAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2023-11-17 07:50:11
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 104.28.251.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 17 02:49:57.923866 2023] [security2:error] [pid 30733] [client 104.28.251.52:62936] [client 104 ...
show more
(mod_security) mod_security (id:210730) triggered by 104.28.251.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 17 02:49:57.923866 2023] [security2:error] [pid 30733] [client 104.28.251.52:62936] [client 104.28.251.52] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||72blues.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "72blues.com"] [uri "/db.conf"] [unique_id "ZVcbJdeSFYfWTss-5Ua0kgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
