This IP address has been reported a total of
12
times from
12 distinct
sources.
8.218.65.140 was first reported on
October 21st 2026 , and the most recent report was
2 hours ago United States of America
with 4
reports;
Germany
with 2
reports;
Canada
with 1
report.
The most common categories in these recent reports were:
Port Scan
5
times;
Web App Attack
4
times;
SQL Injection
3
times;
Brute-Force
1
time;
Bad Web Bot
1
time;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
Ano_Nym
2026-10-25 02:40:31
(2 hours ago)
CrowdSec IDS alert on VPS 85.215.198.123 (DE). Scenario: crowdsecurity/http-sensitive-files
Web App Attack
🇺🇸
cazae
2026-10-24 21:53:54
(7 hours ago)
Unauthorized attempt on debian [443/tcp]
Source port: 54574
TTL: 237
Packet length: 44
TOS: 0x08
ht ...
show more
Unauthorized attempt on debian [443/tcp]
Source port: 54574
TTL: 237
Packet length: 44
TOS: 0x08
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
shabi
2026-10-24 21:40:06
(7 hours ago)
UFW Blocked [8443/TCP]
Source: 8.218.65.140:54558
TTL: 235
Lenth: 44
TOS: 0x00
Port Scan
🇺🇸
itsnixk
2026-10-24 21:03:46
(8 hours ago)
(mod_security) mod_security (id:920350) triggered by 8.218.65.140 (HK/Hong Kong/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:920350) triggered by 8.218.65.140 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 24 17:03:44.532606 2026] [security2:error] [pid 2201861:tid 2202002] [client 8.218.65.140:55466] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "at0dMNrRKeZrA6H0f5xVmwAAADo"]
show less
Port Scan
🇨🇦
Roper123
2026-10-24 15:50:30
(13 hours ago)
Web exploits
Hacking
Web App Attack
🇫🇮
payincog
2026-10-23 23:00:28
(1 day ago)
Date: Oct 24 01:42:46 2026 EAT | Reported IP: 8.218.65.140 mod_security | id: 920350 930130 949110 9 ...
show more
Date: Oct 24 01:42:46 2026 EAT | Reported IP: 8.218.65.140 mod_security | id: 920350 930130 949110 920440 | HK/pay.zagaavipato.com/- | Connections: 1 | Blocked: Permanent Block: [LF_MODSEC] | Logs: ; Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Host header is a numeric IP address; Restricted File Access Attempt; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Host
show less
SQL Injection
Brute-Force
Bad Web Bot
🇩🇪
pcpiefke
2026-10-23 21:22:09
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 8.218.65.140 (HK/Hong Kong/-)
SQL Injection
🇮🇪
AutosOnShow
2026-10-23 16:24:08
(1 day ago)
blocked for webapp attack | path requested: /config.backup | seen at 2026-10-23 16:23:16.589 |
Web App Attack
🇷🇺
cnaize
2026-10-22 22:04:56
(2 days ago)
Malicious activity blocked by Meds firewall
Port Scan
🇫🇷
Bensay
2026-10-22 08:47:57
(2 days ago)
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result ...
show more
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=Mozilla/5.0
show less
Port Scan
2026-10-21 16:13:05
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 8.218.65.140 (HK/Hong Kong/-)
SQL Injection
🇯🇵
knock
2026-10-21 12:18:12
(3 days ago)
Knock-Knock honeypot brute-force: HTTP (3 total hits)
Web App Attack
Showing 1 to
12
of 12 reports
