This IP address has been reported a total of
13
times from
13 distinct
sources.
136.110.66.163 was first reported on
September 21st 2026 , and the most recent report was
2 weeks ago United States of America
with 3
reports;
Germany
with 2
reports;
Netherlands
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
10
times;
Brute-Force
4
times;
Bad Web Bot
4
times;
Hacking
2
times;
Port Scan
1
time;
Other
1
time.
Old Reports
The most recent abuse report for this IP address is from
2 weeks ago
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
Matthew Ping
2026-09-22 03:30:01
(2 weeks ago)
Excessive connections (DDoS/flood) blocked by CSF CT_LIMIT on wp3.
DDoS Attack
Brute-Force
🇺🇸
Power Ca
2026-09-22 01:04:24
(2 weeks ago)
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /.codex/auth.json.save HTTP/2.0" 404 65 "-" "cr ...
show more
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /.codex/auth.json.save HTTP/2.0" 404 65 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /bak/.codex/auth.json HTTP/2.0" 404 64 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /old/.config/codex/auth.json HTTP/2.0" 404 71 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /codex/auth.json HTTP/2.0" 404 59 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /.claude/settings.local.json HTTP/2.0" 404 71 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /.codex/auth.json.bak HTTP/2.0" 404 64 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /old/.codex/auth.json HTTP/2.0" 404 64 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000] "GET /.codex/config.json HTTP/2.0" 404 62 "-" "crusader-worker/1.0"
136.110.66.163 - - [22/Sep/2026:01:04:23 +0000]
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 22:45:48
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.110.66.163 (163.66.110.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 136.110.66.163 (163.66.110.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 18:45:43.322839 2026] [security2:error] [pid 32118:tid 32234] [client 136.110.66.163:58146] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.plasticsurgery.aafm.us|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.plasticsurgery.aafm.us"] [uri "/.codex/auth.json.bak"] [unique_id "arGzl9kYlmdFPxDW6n8KIAAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-21 19:06:29
(2 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
🇩🇪
ghostwarriors
2026-09-21 18:20:10
(2 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-21 18:03:09
(2 weeks ago)
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /var/www/.codex/auth.json HTTP/1.1" 404 4445 "- ...
show more
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /var/www/.codex/auth.json HTTP/1.1" 404 4445 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 4444 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /srv/.codex/auth.json HTTP/1.1" 404 4444 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /htdocs/.codex/auth.json HTTP/1.1" 404 4443 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /home/.codex/auth.json HTTP/1.1" 404 4445 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /config/.codex/auth.json HTTP/1.1" 404 4444 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /api/.codex/auth.json HTTP/1.1" 404 4443 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/2026:20:03:05 +0200] "GET /tmp/.codex/auth.json HTTP/1.1" 404 4444 "-" "crusader-worker/1.0"
136.110.66.163 - - [21/Sep/20
show less
Bad Web Bot
🇪🇸
robotstxt
2026-09-21 17:54:45
(2 weeks ago)
136.110.66.163 - - [21/Sep/2026:17:54:19 +0000] "GET /api/.codex/auth.json HTTP/1.1" 403 79534 "-" " ...
show more
136.110.66.163 - - [21/Sep/2026:17:54:19 +0000] "GET /api/.codex/auth.json HTTP/1.1" 403 79534 "-" "crusader-worker/1.0" "-" edge="136.110.66.163"
136.110.66.163 - - [21/Sep/2026:17:54:19 +0000] "GET /uploads/.codex/auth.json HTTP/1.1" 403 79527 "-" "crusader-worker/1.0" "-" edge="136.110.66.163"
136.110.66.163 - - [21/Sep/2026:17:54:19 +0000] "GET /tmp/.codex/auth.json HTTP/1.1" 403 79527 "-" "crusader-worker/1.0" "-" edge="136.110.66.163"
136.110.66.163 - - [21/Sep/2026:17:54:19 +0000] "GET /.claude.json HTTP/1.1" 403 79522 "-" "crusader-worker/1.0" "-" edge="136.110.66.163"
136.110.66.163 - - [21/Sep/2026:17:54:20 +0000] "GET /old/.claude.json HTTP/1.1" 403 79527 "-" "crusader-worker/1.0" "-" edge="136.110.66.163"
...
show less
Web App Attack
🇨🇭
leo1305
2026-09-21 17:04:01
(2 weeks ago)
CrowdSec detection | scenario: http-probing
Port Scan
Web App Attack
🇬🇧
consul.to
2026-09-21 12:30:35
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
masterguru
2026-09-21 11:02:34
(2 weeks ago)
Restricted File Access Attempt. Matched phrase "/auth.json" at REQUEST_FILENAME. (930130-196)
Hacking
Web App Attack
🇫🇮
paissangroup
2026-09-21 10:19:11
(2 weeks ago)
Multiple WAF Violations
Web App Attack
2026-09-21 09:54:49
(2 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇳🇱
debestelapp
2026-09-21 06:56:19
(2 weeks ago)
Web App Attack
Showing 1 to
13
of 13 reports
