🇮🇱
spd.co.il
2026-09-22 16:02:29
UTC ·
(1 month ago)
Web application attack detected
Hacking
Web App Attack
🇺🇸
xmission.com
2026-09-21 07:50:10
UTC ·
(1 month ago)
Blocked by UFW (TCP on 80)
Source port: 51566
TTL: 52
Packet length: 60
TOS: 0x00
This report (for 172.98.192.202) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
Web App Attack
🇧🇷
NOCVIU
2026-09-20 19:02:51
UTC ·
(1 month ago)
Honeypot/Firewall detectou varredura não solicitada ou brute-force Inbound nas portas: 80, 443. Total de conexões droppadas: 4.
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-09-20 07:41:14
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 172.98.192.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 03:41:09.957371 2026] [security2:error] [pid 8480:tid 8523] [client 172.98.192.202:46746] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.98.192.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 03:41:09.957371 2026] [security2:error] [pid 8480:tid 8523] [client 172.98.192.202:46746] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.81"] [uri "/.env"] [unique_id "aq-OFan4ezEmNhiacerknQAAAMA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
sockominfo
2026-09-18 23:00:53
UTC ·
(1 month ago)
Active Response: IP 172.98.192.202 Blocked via Firewall Drop. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Netwo ...
show more
Active Response: IP 172.98.192.202 Blocked via Firewall Drop. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-09-18 22:00:09
UTC ·
(1 month ago)
Active Response: IP 172.98.192.202 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT
Hacking
Web App Attack
🇳🇱
Savvii
2026-09-18 21:10:59
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on storm
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-18 19:46:22
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on lime
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
cg-design.co.uk
2026-09-18 19:23:48
UTC ·
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 172.98.192.202 (US/United States/-)
SQL Injection
🇩🇪
AetherFox
2026-09-18 18:11:21
UTC ·
(1 month ago)
AetherFox VoidGuard detected: [Fri Sep 18 18:11:20.777574 2026] [authz_core:error] [pid 534806:tid 534891] [client 172.98.192.202:46480] AH01630: client denied by server configuration: /var/www/html/
[Fri Sep 18 18:11:20.777720 2026] [authz_core:erro ...
show more
AetherFox VoidGuard detected: [Fri Sep 18 18:11:20.777574 2026] [authz_core:error] [pid 534806:tid 534891] [client 172.98.192.202:46480] AH01630: client denied by server configuration: /var/www/html/
[Fri Sep 18 18:11:20.777720 2026] [authz_core:error] [pid 534806:tid 534891] [client 172.98.192.202:46480] AH01630: client denied by server configuration: /var/www/ERRORpages/403.html
[Fri Sep 18 18:11:21.039632 2026] [authz_core:error] [pid 534806:tid 534848] [client 172.98.192.202:46948] AH01630: client denied by server configuration: /var/www/html/
[Fri Sep 18 18:11:21.040251 2026] [authz_core:error] [pid 534806:tid 534848] [client 172.98.192.202:46948] AH01630: client denied by server configuration: /var/www/ERRORpages/403.html
[Fri Sep 18 18:11:21.418516 2026] [authz_core:error] [pid 534808:tid 534877] [client 172.98.192.202:47300] AH01630: client denied by server configuration: /var/www/html/robots.txt
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Kejult
2026-09-18 16:22:26
UTC ·
(1 month ago)
Honeypot Finding: repeated TCP service probing on TCP/80 (HTTP); 15 application-level events across 15 source port(s). Sensor(s): Tanner.
Port Scan
Anonymous
2026-09-18 14:48:14
UTC ·
(1 month ago)
172.98.192.202 - - [18/Sep/2026:16:48:13 +0200] "HEAD / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
172.98.192.202 - - [18/Sep/2026:16:48:13 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; U ...
show more
172.98.192.202 - - [18/Sep/2026:16:48:13 +0200] "HEAD / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
172.98.192.202 - - [18/Sep/2026:16:48:13 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-09-18 08:25:19
UTC ·
(1 month ago)
Knock-Knock HTTP honeypot activity; time=2026-09-18 08:19:40; http_method=HEAD; http_path=/; http_purpose=basic_probe; http_user_agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/5
Web App Attack
🇺🇸
IndigoRidge
2026-09-18 07:56:48
UTC ·
(1 month ago)
[18/Sep/2026:03:56:48.059017 --0400] aqzuwDEuzGoTxUyAbLP-fAAAAIY 172.98.192.202 38816 127.0.0.1 7080
[18/Sep/2026:03:56:48.146557 --0400] aqzuwDEuzGoTxUyAbLP-fQAAAIc 172.98.192.202 38818 127.0.0.1 7080
[18/Sep/2026:03:56:48.241058 --0400] aqzuwDEuzGo ...
show more
[18/Sep/2026:03:56:48.059017 --0400] aqzuwDEuzGoTxUyAbLP-fAAAAIY 172.98.192.202 38816 127.0.0.1 7080
[18/Sep/2026:03:56:48.146557 --0400] aqzuwDEuzGoTxUyAbLP-fQAAAIc 172.98.192.202 38818 127.0.0.1 7080
[18/Sep/2026:03:56:48.241058 --0400] aqzuwDEuzGoTxUyAbLP-fgAAAIg 172.98.192.202 38820 127.0.0.1 7080
[18/Sep/2026:03:56:48.310728 --0400] aqzuwC0TWZubuclUKojURgAAAA4 172.98.192.202 38832 127.0.0.1 7080
[18/Sep/2026:03:56:48.413598 --0400] aqzuwDEuzGoTxUyAbLP-fwAAAIk 172.98.192.202 38838 127.0.0.1 7080
...
show less
Web App Attack
🇯🇵
HeliJP
2026-09-18 02:45:52
UTC ·
(1 month ago)
2026-09-18T01:52:37Z - Recognized attacks\bad behavior from IP address 172.98.192.202 on port 443\80 (3 daily hits): client denied by server configuration
Port Scan
Hacking
SQL Injection
Brute-Force
Web App Attack