Total reports
7 from
6 distinct
reporters
First reported
October 3rd 2026
Most recent report
3 days ago
Last 60 days
Top reporter locations
🇺🇸
United States of America
2
🇩🇪
Germany
1
🇫🇷
France
1
Most common categories
Port Scan
4
Brute-Force
3
Bad Web Bot
2
Hacking
2
Web App Attack
2
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇮🇩
hermawan
2026-10-26 01:01:04
(3 days ago)
[Mon Oct 26 08:01:03.681646 2026] [security2:error] [pid 3052:tid 140497565771456] [client 209.61.48.242:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreru ...
show more
[Mon Oct 26 08:01:03.681646 2026] [security2:error] [pid 3052:tid 140497565771456] [client 209.61.48.242:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "618"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:referer: https://www.bmkg.go.id/ request_line = GET /index.php/analisis-iklim/analisis-bulanan/analisis-distribusi-hujan/analisis-distribusi-curah-hujan HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/analisis-iklim/analisis-bulanan/analisis-distribusi-hujan/analisis-distribusi-curah-hujan"] [unique_id "at6mT5OSry0PaSSmx90bHgAAAE0"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[3179] [3Eg13bMXAEo] [at6mT5OSry0PaSSmx90bHgAAAE0] keep_alive=[0] [2026-10-26 08:01:03.681652] [R:at6mT5OSry0PaSSmx
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-24 17:13:39
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 209.61.48.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:13:35.879367 2026] [security2:error] [pid 11665:tid 11665] [client 209.61.48.242:61136] M ...
show more
(mod_security) mod_security (id:210350) triggered by 209.61.48.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:13:35.879367 2026] [security2:error] [pid 11665:tid 11665] [client 209.61.48.242:61136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||visco174.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "visco174.com"] [uri "/"] [unique_id "atznP44GKLm0vh65Evmb_AAAABc"], referer: https://drcheckerfree.space/dir/seo-visibility-links-226778
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
AbuseIPDB informer
2026-10-15 18:55:08
(1 week ago)
nfdump top talker: 209.61.48.242 | first seen 2026-10-15 21:55:08 | duration 245.248s | flows=132 | packets=328383 | bytes=436092624 | pps=1338 | bps=14225359 | bpp=1328 | proto=udp
DDoS Attack
Port Scan
Exploited Host
🇫🇷
security.rdmc.fr
2026-10-09 16:35:48
(2 weeks ago)
Port Scan Attack proto:TCP src:12216 dst:23
Port Scan
🇷🇸
Scan
2026-10-06 00:44:19
(3 weeks ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-10-03 13:46:45
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 209.61.48.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:46:38.285551 2026] [security2:error] [pid 6479:tid 6479] [client 209.61.48.242:41458] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 209.61.48.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:46:38.285551 2026] [security2:error] [pid 6479:tid 6479] [client 209.61.48.242:41458] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ran101.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ran101.com"] [uri "/"] [unique_id "asEHPrBJZbYdssicqoI0dAAAAAM"], referer: https://onlinebacklinkbuilder.store/dir/seo-backlink-services-172001
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-03 00:26:17
(3 weeks ago)
denied Telnet access attempt. destination port 23.
Port Scan
Brute-Force
