Log in to view charts and search reports for this IP.
Log In
Reports Activity
Example preview
Report Categories (Last 60 Days)
Example preview
Top Reporter Countries (Last 60 Days)
Example preview
Account required for the enhanced features
Log inSign up
IP Abuse Reports for 136.65.205.127
This IP address has been reported a total of
6
times from
6 distinct
sources.
136.65.205.127 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 2
reports;
Canada
with 1
report;
Czechia
with 1
report.
The most common categories in these recent reports were:
Web App Attack
6
times;
Brute-Force
2
times;
Bad Web Bot
2
times;
Hacking
2
times;
DDoS Attack
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
(mod_security) mod_security (id:210492) triggered by 136.65.205.127 (127.205.65.136.bc.googleusercon ...
show more(mod_security) mod_security (id:210492) triggered by 136.65.205.127 (127.205.65.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:20:24.292073 2026] [security2:error] [pid 11333:tid 11333] [client 136.65.205.127:41660] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "swindon-itf.com"] [uri "/.git/config"] [unique_id "arG7uO6RUmSArZv9Dcpt6QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Word ...
show moreBlocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
show less
{"level":"info","ts":1789972375.8389132,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1789972375.8389132,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.65.205.127","remote_port":"50618","client_ip":"136.65.205.127","proto":"HTTP/1.1","method":"GET","host":"up.nien.co","uri":"/.env","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection":["keep-alive"],"Next-Action":["x"],"X-Nextjs-Request-Id":["c6cbb4fc"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"up.nien.co","ech":false}},"bytes_read":0,"user_id":"","duration":0.000215952,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1789972375.8868492,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.65.205.127","remote_port":"50640","client_ip":"136.65.205.1
...
show less
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show moreProbing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.git/config | 2026-09-20 19:28 UTC
show less
Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ...
show moreDetected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 10 matching log events between 2026-09-20T18:01:23Z and 18:21:26Z (UTC). Sample requests: GET /github/.env -> 200; GET /actions/.env -> 200; GET /circleci/.env -> 200; GET /travis/.env -> 200; GET /buildkite/.env -> 200; GET /.git/config -> 200; GET /.env -> 200; GET /.env.local -> 200; GET /.env.staging -> 200; GET /.env.development -> 200
show less
Hacking
Web App Attack
Showing 1 to
6
of 6 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
