86.248.56.20

Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /brands/sony/projectorsanddigitalsignage/shopby/screensize-32-47-55.html?dir=asc&mode=grid&order=most_viewed | UA: Mozilla/5.0 (Macintosh; PPC Mac OS X 10_11_5 rv:4.0; nn-NO) AppleWebKit/533.40.4 (KHTML, like Gecko) Version/5.1 Safari/533.40.4 | (Magento Site) show less

(mod_security) mod_security (id:220150) triggered by 86.248.56.20 (lfbn-lyo-1-1233-20.w86-248.abo.wanadoo.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:37:09.032316 2026] [security2:error] [pid 23889:ti ... show more (mod_security) mod_security (id:220150) triggered by 86.248.56.20 (lfbn-lyo-1-1233-20.w86-248.abo.wanadoo.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:37:09.032316 2026] [security2:error] [pid 23889:tid 23889] [client 86.248.56.20:53700] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:union(?:\\\\/\\\\*.{0,399}\\\\*\\\\/)?select)" at ARGS:C. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5662"] [id "220150"] [rev "5"] [msg "COMODO WAF: SQL injection vulnerability in Ginkgo CMS 5.0 (CVE-2013-5318)||smart1services.com|F|2"] [data "')/**/and/**/('djvvqs'='djvvqs'/**/union/**/all/**/select/**/'kmwjmtfbzweyglezwiqrjkfkjsmsrbbo'--/**/9ulo4a"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "smart1services.com"] [uri "/"] [unique_id "apizJeuH2O8DTZ48VdsO_QAAAB8"] show less

| Multiple SQL injection attempts from same source ip.(multiple servers)

2026-06-29T06:51:21.675225+02:00 soli-gate cyrus/imaps[2607474]: badlogin: lfbn-lyo-1-1233-20.w86-248.abo.wanadoo.fr [86.248.56.20] PLAIN ([email protected]) [SASL(-13): authentication failure: Password verification failed] ...

86.248.56.20 - - [16/Jun/2026:08:08:52 +0900] "GET /pcwiki/index.php?days=30&from=20251130182254&hideliu=1&hideminor=0&title=%ED%8A%B9%EC%88%98%EA%B8%B0%EB%8A%A5:%EB%A7%81%ED%81%AC%EC%B5%9C%EA%B7%BC%EB%B0%94%EB%80%9C HTTP/1.1" 404 460 "-" "Mozilla/5. ... show more 86.248.56.20 - - [16/Jun/2026:08:08:52 +0900] "GET /pcwiki/index.php?days=30&from=20251130182254&hideliu=1&hideminor=0&title=%ED%8A%B9%EC%88%98%EA%B8%B0%EB%8A%A5:%EB%A7%81%ED%81%AC%EC%B5%9C%EA%B7%BC%EB%B0%94%EB%80%9C HTTP/1.1" 404 460 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.182 Safari/537.36" ... show less

(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security

86.248.56.20 | Port: 13446 | DNS: lfbn-lyo-1-1233-20.w86-248.abo.wanadoo.fr 2026-05-04T05:52:34+08:00 Europe/Paris | Fake HTTP Protocol detected! | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 ... show more 86.248.56.20 | Port: 13446 | DNS: lfbn-lyo-1-1233-20.w86-248.abo.wanadoo.fr 2026-05-04T05:52:34+08:00 Europe/Paris | Fake HTTP Protocol detected! | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 HTTP/1.1 443 GET | URL: /fondant-3d-bearbrick-themed | Ref: - | Country: FR/France/+01:00 IP City: Villeurbanne Linux 9f627e505eedc0fb-MRS/Marseille, France 1 hits/0 secs Robots 1 show less