This IP address has been reported a total of
49
times from
17 distinct
sources.
221.6.164.149 was first reported on
June 19th 2026 , and the most recent report was
2 hours ago France
with 12
reports;
United States of America
with 8
reports;
Canada
with 5
reports.
The most common categories in these recent reports were:
Bad Web Bot
24
times;
Web App Attack
23
times;
DDoS Attack
6
times;
Exploited Host
5
times;
Hacking
4
times;
Other
12
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇷
Sklurk
2026-10-15 06:17:09
(2 hours ago)
Web App Attack
Web App Attack
🇫🇷
Sklurk
2026-10-14 05:53:51
(1 day ago)
Web App Attack
Web App Attack
🇫🇷
Sklurk
2026-10-13 04:27:31
(2 days ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 05:47:37
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 221.6.164.149 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 221.6.164.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:47:33.314250 2026] [security2:error] [pid 14377:tid 14377] [client 221.6.164.149:37178] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gapanda.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gapanda.com"] [uri "/php-old.ini"] [unique_id "asx0dSGCt5BbCu4bZikJ3gAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-10-10 11:00:28
(4 days ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 11:21:42
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 221.6.164.149 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 221.6.164.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 07:21:38.980716 2026] [security2:error] [pid 24066:tid 24066] [client 221.6.164.149:33336] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.coolwebsites.org|F|2"] [data ".cleveland.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.coolwebsites.org"] [uri "/http;/www.cleveland.com"] [unique_id "asjOQh7eo35EDXwjF-7rOwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-10-09 03:55:01
(6 days ago)
Web App Attack
Web App Attack
🇨🇦
trainiax
2026-10-06 10:37:28
(1 week ago)
Excessive crawling / scraping
Bad Web Bot
🇺🇸
SX Communications
2026-10-06 05:08:18
(1 week ago)
HTTP application-layer DoS / botnet traffic from 221.6.164.149: repeated high-cost dynamic page and ...
show more
HTTP application-layer DoS / botnet traffic from 221.6.164.149: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-06 01:46:48
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 221.6.164.149 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 221.6.164.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 21:46:42.993773 2026] [security2:error] [pid 25318:tid 25318] [client 221.6.164.149:48038] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.steinmetzjewelers.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.steinmetzjewelers.com"] [uri "/gpahomeinspections.com"] [unique_id "asRTAlFUkgzqdsLpQjyD9QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
David Koswari
2026-10-05 05:21:00
(1 week ago)
REQ_BLOCKED_ACL
DDoS Attack
FTP Brute-Force
Ping of Death
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted
🇫🇷
Sklurk
2026-10-04 12:40:22
(1 week ago)
Web App Attack
Web App Attack
🇫🇷
Sklurk
2026-10-03 11:46:14
(1 week ago)
Web App Attack
Web App Attack
🇨🇦
trainiax
2026-10-03 08:27:23
(1 week ago)
Excessive crawling / scraping
Bad Web Bot
🇨🇦
trainiax
2026-10-02 08:37:50
(1 week ago)
Excessive scraping
DDoS Attack
Bad Web Bot
Showing 1 to
15
of 49 reports
