Total reports
5 from
4 distinct
reporters
First reported
September 14th 2025
Most recent report
12 minutes ago
Last 60 days
Top reporter locations
🇩🇪
Germany
4
Most common categories
Bad Web Bot
2
Web App Attack
2
Brute-Force
1
Hacking
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
ghostwarriors
2026-11-15 08:20:07
UTC ·
(12 minutes ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-15 08:12:45
UTC ·
(19 minutes ago)
42.6.173.3 - - [15/Nov/2026:09:12:41 +0100] "GET /update.php HTTP/1.1" 404 763 "http://[site]/update.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11"
42.6.173.3 - - [15/Nov/2026:09:12 ...
show more
42.6.173.3 - - [15/Nov/2026:09:12:41 +0100] "GET /update.php HTTP/1.1" 404 763 "http://[site]/update.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11"
42.6.173.3 - - [15/Nov/2026:09:12:41 +0100] "GET /install.php HTTP/1.1" 404 584 "http://[site]/install.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11"
42.6.173.3 - - [15/Nov/2026:09:12:41 +0100] "GET /db_config.php HTTP/1.1" 404 584 "http://[site]/db_config.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11"
42.6.173.3 - - [15/Nov/2026:09:12:42 +0100] "GET /ant.php HTTP/1.1" 404 584 "http://[site]/ant.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11"
42.6.173.3 - - [15/Nov/2026:09:12:42 +0100] "GET /godzilla.php HTTP/1.1" 404 584 "http://[site]/godzilla.php" "Mozilla/5.0 (Window
show less
Web App Attack
Hacking
🇩🇪
LRob
2026-11-13 11:01:17
UTC ·
(1 day ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11 | 2026-11-13 11:01 UTC
Bad Web Bot
🇩🇪
LRob
2026-11-13 02:47:55
UTC ·
(2 days ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11 | src_port: 16989
Bad Web Bot
🇺🇸
TPI-Abuse
2025-09-14 10:13:58
UTC ·
(1 year ago)
(mod_security) mod_security (id:210350) triggered by 42.6.173.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 14 06:13:49.324569 2025] [security2:error] [pid 19254:tid 19254] [client 42.6.173.3:50867] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 42.6.173.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 14 06:13:49.324569 2025] [security2:error] [pid 19254:tid 19254] [client 42.6.173.3:50867] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.renju.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/game/95245/"] [unique_id "aMaVXft2E8XzW8Oc4adK4AAAAAI"], referer: https://www.renju.net/game/95245
show less
Brute-Force
Bad Web Bot
Web App Attack
