This IP address has been reported a total of
7
times from
4 distinct
sources.
218.88.197.131 was first reported on
May 6th 2026 , and the most recent report was
4 days ago Italy
with 2
reports;
Spain
with 1
report;
United Kingdom of Great Britain and Northern Ireland
with 1
report.
The most common categories in these recent reports were:
Brute-Force
3
times;
Bad Web Bot
1
time;
Exploited Host
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇮🇹
www.tana.it
2026-10-18 02:55:33
(4 days ago)
SMTP auth dictionary attack
Brute-Force
🇪🇸
librebit
2026-10-17 10:13:54
(4 days ago)
Attack to Postfix SASL, bad guys
Brute-Force
🇮🇹
www.tana.it
2026-10-16 21:15:01
(5 days ago)
SMTP auth dictionary attack
Brute-Force
2026-08-26 15:04:09
(1 month ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Exploited Host
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-08 10:47:34
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 218.88.197.131 (131.197.88.218.broad.cd.sc.dyna ...
show more
(mod_security) mod_security (id:210730) triggered by 218.88.197.131 (131.197.88.218.broad.cd.sc.dynamic.163data.com.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 06:46:46.283861 2026] [security2:error] [pid 23900:tid 23900] [client 218.88.197.131:30308] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bigholegolf.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bigholegolf.com"] [uri "/1.sql"] [unique_id "af2_FnO-GO9M2EemZGBLdQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-07 10:30:43
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 218.88.197.131 (131.197.88.218.broad.cd.sc.dyna ...
show more
(mod_security) mod_security (id:210730) triggered by 218.88.197.131 (131.197.88.218.broad.cd.sc.dynamic.163data.com.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 06:30:24.896721 2026] [security2:error] [pid 21219:tid 21362] [client 218.88.197.131:30210] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||yourwitch.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "yourwitch.com"] [uri "/yourwitch_com.bak"] [unique_id "afxpwCk8wgYBDPbLb_qv5wAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-06 23:03:19
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 218.88.197.131 (131.197.88.218.broad.cd.sc.dyna ...
show more
(mod_security) mod_security (id:210730) triggered by 218.88.197.131 (131.197.88.218.broad.cd.sc.dynamic.163data.com.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 19:02:54.055522 2026] [security2:error] [pid 25593:tid 25593] [client 218.88.197.131:29750] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bigchus.com|F|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bigchus.com"] [uri "/www.backup"] [unique_id "afvInmld__uMgNbOPkz8JgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
7
of 7 reports
