AbuseIPDB » 136.243.149.182

136.243.149.182 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 39%: ?

39%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	static.182.149.243.136.clients.your-server.de
Domain Name	hetzner.com
Country	Germany
City	Falkenstein, Saxony

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 136.243.149.182

Whois 136.243.149.182

IP Abuse Reports for 136.243.149.182:

This IP address has been reported a total of 24 times from 15 distinct sources. 136.243.149.182 was first reported on December 12th 2024, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rtbh.com.tr	2024-12-14 20:52:43 (1 month ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
SkyDancer	2024-12-14 16:24:39 (1 month ago)	Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by ... show moreMultiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-A-X show less	Hacking Brute-Force SSH
Anonymous	2024-12-13 22:37:07 (1 month ago)	Infected user bad webscan	Exploited Host
TPI-Abuse	2024-12-13 20:55:35 (1 month ago)	(mod_security) mod_security (id:243930) triggered by 136.243.149.182 (static.182.149.243.136.clients ... show more(mod_security) mod_security (id:243930) triggered by 136.243.149.182 (static.182.149.243.136.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 13 15:55:30.079452 2024] [security2:error] [pid 5644:tid 5644] [client 136.243.149.182:53705] [client 136.243.149.182] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?:\\\\w+\\\\/[\\\\w\\\\-\\\\.]+)(?:;(?:charset=[\\\\w\\\\-]{1,18}\|boundary=[\\\\w\\\\-]+)?)?$" against "REQUEST_HEADERS:Content-Type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6743"] [id "243930"] [rev "2"] [msg "COMODO WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)\|\|www.genevainvestors.com:80\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.genevainvestors.com"] [uri "/"] [unique_id "Z1yfQpNBXISADQE9B2RX6QAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-12-13 19:51:00 (1 month ago)	Ports: 80,443; Direction: 1; Trigger: LF_CXS	Brute-Force SSH
Cloudkul Cloudkul	2024-12-13 18:35:10 (1 month ago)	Attempted Not Found (404 status code) requests on our application, more than 30% of their total requ ... show moreAttempted Not Found (404 status code) requests on our application, more than 30% of their total requests. show less	Brute-Force Web App Attack
COMAITE	2024-12-13 17:05:59 (1 month ago)	Multiple web server 400 error codes from same source ip 136.243.149.182.	Web App Attack
yukon.ca	2024-12-13 14:18:48 (1 month ago)	Web Server Enforcement Violation: Object-Graph Navigation Language Injection Port:80	Hacking Exploited Host
4server	2024-12-13 13:51:32 (1 month ago)	[FriDec1314:51:28.7731922024][security2:error][pid3617526:tid3617668][client136.243.149.182:0][clien ... show more[FriDec1314:51:28.7731922024][security2:error][pid3617526:tid3617668][client136.243.149.182:0][client136.243.149.182]ModSecurity:Accessdeniedwithcode403$phase2$.File\"/tmp/20241213-145125-Z1w73Vn7Mryp264iQ3kPeQAAANE-file-fyJGNX\"rejectedbytheapproverscript\"/etc/cxs/cxscgi.sh\":0[file\"/etc/apache2/conf.d/modsec_vendor_configs/configserver/00_configserver.conf\"][line\"7\"][id\"1010101\"][msg\"ConfigServerExploitScanner$cxs$triggered\"][severity\"CRITICAL\"][hostname\"www.shakary.com\"][uri\"/index.php\"][unique_id\"Z1w73Vn7Mryp264iQ3kPeQAAANE\"] show less	Blog Spam
TPI-Abuse	2024-12-13 12:39:21 (1 month ago)	(mod_security) mod_security (id:243930) triggered by 136.243.149.182 (static.182.149.243.136.clients ... show more(mod_security) mod_security (id:243930) triggered by 136.243.149.182 (static.182.149.243.136.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 13 07:39:14.758451 2024] [security2:error] [pid 8187:tid 8187] [client 136.243.149.182:61261] [client 136.243.149.182] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?:\\\\w+\\\\/[\\\\w\\\\-\\\\.]+)(?:;(?:charset=[\\\\w\\\\-]{1,18}\|boundary=[\\\\w\\\\-]+)?)?$" against "REQUEST_HEADERS:Content-Type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6743"] [id "243930"] [rev "2"] [msg "COMODO WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)\|\|www.brokenglasstelecom.com:80\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.brokenglasstelecom.com"] [uri "/"] [unique_id "Z1wq8tQaGlqjLg6OIJIMrgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
FeG Deutschland	2024-12-13 07:01:01 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14	Exploited Host Web App Attack
Anonymous	2024-12-13 06:43:39 (1 month ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-12-13 01:13:29 (1 month ago)	Ports: 80,443; Direction: 0; Trigger: LF_MODSEC	Brute-Force SSH
Anonymous	2024-12-13 00:50:03 (1 month ago)	Infected user bad webscan	Exploited Host
yukon.ca	2024-12-12 21:38:24 (1 month ago)	Web Server Enforcement Violation: Atlassian Confluence Remote Code Execution (CVE-2022-26134) ... show moreWeb Server Enforcement Violation: Atlassian Confluence Remote Code Execution (CVE-2022-26134) Port:80 show less	Hacking Exploited Host