Total reports
6 from
5 distinct
reporters
First reported
September 27th 2026
Most recent report
17 hours ago
Last 60 days
Top reporter locations
🇺🇸
United States of America
4
🇩🇪
Germany
2
Most common categories
Bad Web Bot
4
Web App Attack
4
Brute-Force
2
DDoS Attack
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
LRob
2026-11-10 10:03:21
UTC ·
(17 hours ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/ed7cb485dc660613f94289c2a58b65642e9ec0b7/internal/config/edit_language.go | src_port: 44035 | ua: Mozilla/5.0 (M ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/ed7cb485dc660613f94289c2a58b65642e9ec0b7/internal/config/edit_language.go | src_port: 44035 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇺🇸
HJ5Ss4Ju
2026-10-25 20:17:19
UTC ·
(2 weeks ago)
Wordfence firewall block
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 08:20:28
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 196.3.218.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:20:22.639574 2026] [security2:error] [pid 9952:tid 9952] [client 196.3.218.189:39466] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 196.3.218.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:20:22.639574 2026] [security2:error] [pid 9952:tid 9952] [client 196.3.218.189:39466] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||coyotebytes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coyotebytes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atxqRkqyJb407rSvpjA6awAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 04:52:51
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 196.3.218.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:52:45.253420 2026] [security2:error] [pid 12106:tid 12106] [client 196.3.218.189:55394] M ...
show more
(mod_security) mod_security (id:225170) triggered by 196.3.218.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:52:45.253420 2026] [security2:error] [pid 12106:tid 12106] [client 196.3.218.189:55394] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||joebankx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "joebankx.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atw5nXVuoDQGqxokXgZOWwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-23 07:24:31
UTC ·
(2 weeks ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
鬼影233
2026-09-27 19:05:04
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
