Total reports
6 from
5 distinct
reporters
First reported
July 10th 2024
Most recent report
2 days ago
Last 60 days
Top reporter locations
🇨🇭
Switzerland
1
Most common categories
Bad Web Bot
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇨🇭
backslash
2026-11-12 21:33:00
UTC ·
(2 days ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
🇩🇪
LRob
2026-08-21 15:42:16
UTC ·
(2 months ago)
L7 DDoS: distributed flood on a shop's faceted search — automated requests to search/sort URLs, one or two per address from thousands of addresses, no page assets loaded | path: /18-velo-route | query: q=Stock+magasin-Cycling+H%C3%A9nin%5C-Beaumont-C ...
show more
L7 DDoS: distributed flood on a shop's faceted search — automated requests to search/sort URLs, one or two per address from thousands of addresses, no page assets loaded | path: /18-velo-route | query: q=Stock+magasin-Cycling+H%C3%A9nin%5C-Beaumont-Cycling+Montpellier/Taille-S-XL/Famille-Metrix-Speedster-Speester-Xelius-Crosshil
show less
DDoS Attack
Web App Attack
2026-07-08 05:29:02
UTC ·
(4 months ago)
Malicious activity detected
Hacking
Web App Attack
2025-11-30 07:11:56
UTC ·
(11 months ago)
Web app attack and vulnerability scan detected from IIS logs
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-15 11:45:08
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 159.148.130.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 06:45:01.564120 2025] [security2:error] [pid 25672:tid 25672] [client 159.148.130.248:4604 ...
show more
(mod_security) mod_security (id:225170) triggered by 159.148.130.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 06:45:01.564120 2025] [security2:error] [pid 25672:tid 25672] [client 159.148.130.248:4604] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.vangentholding.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.vangentholding.com"] [uri "/wp-json/wp/v2/users/257417"] [unique_id "aRhnvZzVwB9TLMcNXGsDrwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-07-10 21:06:50
UTC ·
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 159.148.130.248 (159-148-130-248.cloudtelek.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 10 17:06:46.758440 2024] [security2:error] [pid 3503] [client 15 ...
show more
(mod_security) mod_security (id:225170) triggered by 159.148.130.248 (159-148-130-248.cloudtelek.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 10 17:06:46.758440 2024] [security2:error] [pid 3503] [client 159.148.130.248:28635] [client 159.148.130.248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.vangentholding.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.vangentholding.com"] [uri "/wp-json/wp/v2/users/184121"] [unique_id "Zo735iF02rXu8WZTyS_jbQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
