🇪🇸
Michael McCarthy
2026-10-23 14:56:32
(1 day ago)
Web Spam
🇨🇭
YF
2026-09-01 00:05:45
(1 month ago)
Malicious web activity confirmed — IP previously flagged as suspicious (automated re-check, score: 2 ...
show more
Malicious web activity confirmed — IP previously flagged as suspicious (automated re-check, score: 22%)
show less
Web App Attack
🇩🇪
Jochen Pretli
2026-08-30 18:37:32
(1 month ago)
connection to honeypot
Email Spam
Port Scan
🇧🇷
ICS Labs
2026-08-25 12:12:38
(1 month ago)
ICS Labs identified 161.115.235.36 as a malicious indicator from threat intelligence.
DDoS Attack
Hacking
Exploited Host
🇪🇸
librebit
2026-08-02 01:06:18
(2 months ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-07-13 21:53:30
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 17:53:22.249194 2026] [security2:error] [pid 6758:tid 6758] [client 161.115.235.36:57519] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.voodooshop.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.voodooshop.com"] [uri "/contact"] [unique_id "alVeUr9gWC-IAiHDwV_sHQAAAAs"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 02:30:48
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 22:30:40.638897 2026] [security2:error] [pid 5713:tid 5735] [client 161.115.235.36:50243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||barnetts.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "barnetts.us"] [uri "/"] [unique_id "ak22UJIqS61A9QJDR2o7EQAAAFM"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-01 15:27:27
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 11:27:22.369505 2026] [security2:error] [pid 32674:tid 32674] [client 161.115.235.36:37753] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||watongalodging.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "watongalodging.com"] [uri "/"] [unique_id "akUx2tnqPIOHi9DmSBCuVgAAAA0"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-01 09:09:11
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 05:09:06.613805 2026] [security2:error] [pid 27467:tid 27561] [client 161.115.235.36:54191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.morganswarsong.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.morganswarsong.com"] [uri "/"] [unique_id "akTZMntWao1J7G0h5kehHAAAAI0"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-06-03 11:33:21
(4 months ago)
ICS Labs identified 161.115.235.36 as a malicious indicator from threat intelligence.
DDoS Attack
Hacking
Exploited Host
🇺🇸
Lezetho
2026-05-27 14:00:12
(4 months ago)
DDoS, WebSpam, Web Attack, and Brute-force blocked by Cloudflare
DDoS Attack
Email Spam
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-05-27 01:25:00
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 21:24:51.793582 2026] [security2:error] [pid 25122:tid 25172] [client 161.115.235.36:55129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.thetooheys.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.thetooheys.com"] [uri "/patzer/"] [unique_id "ahZH4_9Tyy9zXpUM-SnmSQAAAE0"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-16 17:01:01
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 13:00:55.571996 2026] [security2:error] [pid 6262:tid 6262] [client 161.115.235.36:49563] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||noscentpro.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "noscentpro.com"] [uri "/"] [unique_id "agiix4qIV5yvpkEffuBeFAAAAA4"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-16 13:02:44
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 09:02:40.338435 2026] [security2:error] [pid 27577:tid 27577] [client 161.115.235.36:60127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||4azadi.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "4azadi.org"] [uri "/"] [unique_id "aghq8J1Yk-dmtOgf7WLTyAAAAAA"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-04 23:55:05
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 161.115.235.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 19:54:58.295458 2026] [security2:error] [pid 31822:tid 31822] [client 161.115.235.36:41805] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||icl1.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "icl1.org"] [uri "/"] [unique_id "afkx0g2BqsMNTug5s_IvLwAAAAA"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
