This IP address has been reported a total of
6
times from
5 distinct
sources.
185.137.39.165 was first reported on
June 13th 2025 , and the most recent report was
1 month ago Netherlands
with 1
report.
The most common categories in these recent reports were:
Brute-Force
1
time;
SSH
1
time.
Old Reports
The most recent abuse report for this IP address is from
1 month ago
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇳🇱
Aitech DevOps
2026-08-24 03:45:15
(1 month ago)
Fail2Ban nginx-botsearch banned 185.137.39.165 after 2 attempts
Brute-Force
SSH
🇺🇸
thefoofighter
2025-10-27 22:19:37
(11 months ago)
[Mon Oct 27 22:19:36.444405 2025] [:error] [pid 3106885] [client 185.137.39.165:65064] [client 185.1 ...
show more
[Mon Oct 27 22:19:36.444405 2025] [:error] [pid 3106885] [client 185.137.39.165:65064] [client 185.137.39.165] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 18)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.sourcemodding.com"] [uri "/comeonin/admin-ajax.php"] [unique_id "aP_v-CcQ3R5WHKuAGw-HAwAAABQ"]
[Mon Oct 27 22:19:36.931013 2025] [:error] [pid 3106885] [client 185.137.39.165:65064] [client 185.137.39.165] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 18)"] [severity "CR
...
show less
Bad Web Bot
Web App Attack
🇳🇱
exxos
2025-09-03 02:03:01
(1 year ago)
Attacks with Bad user agents
Hacking
🇺🇸
rsa
2025-06-13 15:54:00
(1 year ago)
HEAD /access.log HTTP/1.1
Web App Attack
🇺🇸
TPI-Abuse
2025-06-13 02:39:43
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 185.137.39.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 185.137.39.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 12 22:39:38.397057 2025] [security2:error] [pid 3048913:tid 3048913] [client 185.137.39.165:61514] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ken-hensley.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ken-hensley.com"] [uri "/requests.log"] [unique_id "aEuPasuFzAz1-4ohawVAHQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-13 02:18:31
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 185.137.39.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 185.137.39.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 12 22:18:22.679312 2025] [security2:error] [pid 3114819:tid 3114819] [client 185.137.39.165:64048] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bodybuildbid.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bodybuildbid.com"] [uri "/log/access.log"] [unique_id "aEuKbn7f_Nf5SYMtNwWKhwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
6
of 6 reports
