This IP address has been reported a total of
29
times from
25 distinct
sources.
136.80.130.24 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 7
reports;
Netherlands
with 7
reports;
United States of America
with 7
reports.
The most common categories in these recent reports were:
Web App Attack
22
times;
Bad Web Bot
9
times;
Hacking
7
times;
Brute-Force
7
times;
SQL Injection
2
times;
Other
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Sent ~25+ rapid web attacks in ~6 seconds (19:47:44-19:47:50): PHP remote-file-include RCE payloads, ...
show moreSent ~25+ rapid web attacks in ~6 seconds (19:47:44-19:47:50): PHP remote-file-include RCE payloads, command-exec/web-shell probes, an LFI path-traversal, and a large secret/config-enumeration sweep. Every request returned 403/404 (all blocked, nothing returned).
Target: HTTP 80/443: POST /cgi-bin/php-cgi.exe and /index.php with +ADd+allow_url_include+auto_prepend_file=php://input (PHP RCE); POST /exec-py, /api/fs/exec, /icecoder/lib/terminal-xhr.php (command-exec/...
Seen: 2026-10-13 19:47-19:48 EDT
- 19:47:48 POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1 -> 404
- 19:47:48 POST /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1 -> 404
- 19:47:48 POST /icecoder/lib/terminal-xhr.php HTTP/1.1 -> 404 (icecoder web-shell probe)
- 19:47:48 POST /api/fs/exec HTTP/1.1 -> 404 (command-exec probe)
- 19:47:45 GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1 -> 404 (LFI path traversal)
show less
{"level":"info","ts":1791920479.5728502,"logger":"http.log.access.log0","msg":"handled request","req ...
show more{"level":"info","ts":1791920479.5728502,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"136.80.130.24","remote_port":"34330","client_ip":"136.80.130.24","proto":"HTTP/2.0","method":"GET","host":"khtr.status.updown.io","uri":"/static//.env","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"],"Accept":["*/*"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"khtr.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000204249,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1791920479.5749135,"logger":"http.log.acc
...
show less
DDoS Attack
Web App Attack
Anonymous
| Multiple common web attacks from same source ip. (multiple servers)
(mod_security) mod_security (id:949110) triggered by 136.80.130.24 (US/United States/24.130.80.136.b ...
show more(mod_security) mod_security (id:949110) triggered by 136.80.130.24 (US/United States/24.130.80.136.bc.googleusercontent.com): N in the last X secs
show less
