Total reports
8 from
7 distinct
reporters
First reported
February 15th 2024
Most recent report
20 hours ago
Last 60 days
Top reporter locations
🇩🇪
Germany
1
🇺🇸
United States of America
1
Most common categories
Bad Web Bot
2
DDoS Attack
1
Brute-Force
1
Web App Attack
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
LRob
2026-11-11 08:50:38
UTC ·
(20 hours ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/743c59103fdc71299b360c3cf5cae013188dbe2b/internal/store/field_facets_test.go | src_port: 20432 | ua: Mozilla/5.0 ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/743c59103fdc71299b360c3cf5cae013188dbe2b/internal/store/field_facets_test.go | src_port: 20432 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-16 20:19:57
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 131.196.133.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 16:19:49.560883 2026] [security2:error] [pid 6346:tid 6346] [client 131.196.133.141:13392] ...
show more
(mod_security) mod_security (id:210350) triggered by 131.196.133.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 16:19:49.560883 2026] [security2:error] [pid 6346:tid 6346] [client 131.196.133.141:13392] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||yongmeihu.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "yongmeihu.com"] [uri "/"] [unique_id "aqr55SPjp0oYce3WrhYKrAAAAAI"], referer: https://domaincheckeronline.website/dir/strong-domain-backlinks-239470
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-07 00:00:18
UTC ·
(3 months ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
kosada.com
2026-07-31 13:25:08
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-09 16:50:11
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇩
hermawan
2026-05-27 02:20:22
UTC ·
(5 months ago)
[Wed May 27 09:20:14.922670 2026] [security2:error] [pid 419335:tid 139875744474816] [client 131.196.133.141:52788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurit ...
show more
[Wed May 27 09:20:14.922670 2026] [security2:error] [pid 419335:tid 139875744474816] [client 131.196.133.141:52788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "582"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET /index.php/prediksi-iklim/prediksi-dasarian/probabilistik-curah-hujan-provinsi-jawa-timur HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prediksi-iklim/prediksi-dasarian/probabilistik-curah-hujan-provinsi-jawa-timur"] [unique_id "ahZU3iMp2DUqn83cYrQ4TQAAwQA"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[419336] [J713QAM0wHw] [ahZU3iMp2DUqn83cYrQ4TQAAwQA] keep_alive=[1] [2026-05-27 09:20:14.922675] [R:ahZU3iMp2DUqn83cYrQ4TQAAwQA]
...
show less
Email Spam
Hacking
🇧🇷
felipeforte
2025-08-28 01:34:26
UTC ·
(1 year ago)
Part of a massive DDoS/scraping botnet
DDoS Attack
Bad Web Bot
🇬🇷
gbetsis
2024-02-15 12:25:09
UTC ·
(2 years ago)
TCP Port Scanning
Port Scan
Exploited Host
