This IP address has been reported a total of
6
times from
5 distinct
sources.
73.18.206.131 was first reported on
March 17th 2026 , and the most recent report was
6 days ago Germany
with 1
report;
United States of America
with 1
report.
The most common categories in these recent reports were:
Brute-Force
2
times;
Web App Attack
1
time;
Bad Web Bot
1
time;
Port Scan
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
BULLSEYE
2026-09-19 20:02:14
(6 days ago)
Automated IMAP security detection from MailEnable logs. Observed patterns: LOGIN fails=1, AUTHENTICA ...
show more
Automated IMAP security detection from MailEnable logs. Observed patterns: LOGIN fails=1, AUTHENTICATE fails=2, Scanner/Probe=0; Score=6 (weights: login=2, auth=2, scan=2). Top: AUTH_FAIL:CRAM-MD5=1, AUTH_FAIL:LOGIN=1, LOGIN_FAIL=1 (possible IMAP brute-force/credential stuffing). Traffic characteristics strongly indicate automated malicious activity against IMAP.
show less
Port Scan
Brute-Force
🇺🇸
TPI-Abuse
2026-09-17 02:47:10
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 73.18.206.131 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 73.18.206.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:47:06.600933 2026] [security2:error] [pid 12915:tid 12918] [client 73.18.206.131:46534] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nataxcyber.com.venezuelaguia.com"] [uri "/magento/.env.qa"] [unique_id "aqtUqo5qC9PX86EkJTqA4wAAAMA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-07-17 05:12:48
(2 months ago)
WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies
DDoS Attack
Bad Web Bot
🇩🇪
Vegascosmetics
2026-06-20 14:20:19
(3 months ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security
DDoS Attack
Hacking
Exploited Host
🇩🇪
EGP Abuse Dept
2026-06-06 05:12:07
(3 months ago)
Scraping webshop URLs (www.instanttrust.nl), likely botnet drone
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-03-17 00:59:35
(6 months ago)
(mod_security) mod_security (id:210740) triggered by 73.18.206.131 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210740) triggered by 73.18.206.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 16 20:59:29.901531 2026] [security2:error] [pid 772:tid 772] [client 73.18.206.131:52892] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||beatthegm.com|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "beatthegm.com"] [uri "/wp-login.php"] [unique_id "abinccXtTln7TN5g2tok7QAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
6
of 6 reports
