JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 98.198.231.166

98.198.231.166 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 14%: ?

14%

ISP	Comcast Cable Communications, Inc.
Usage Type	Fixed Line ISP
ASN	AS7922
Hostname(s)	c-98-198-231-166.hsd1.tx.comcast.net
Domain Name	comcast.net
Country	🇺🇸 United States of America
City	Houston, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 98.198.231.166

Whois 98.198.231.166

IP Abuse Reports for 98.198.231.166:

This IP address has been reported a total of 28 times from 9 distinct sources. 98.198.231.166 was first reported on November 8th 2025, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 鬼影233	2026-09-24 12:21:44 (4 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 06:25:14 (4 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 05:53:25 (4 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 LRob	2026-09-23 21:27:55 (4 weeks ago)	This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated ... show more This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no browser is behind them. Each participating address sends only one or two such requests, but we count them by the million: a botnet, compromised devices, or abused proxies. The address is blocked. An investigation into what exactly sends these requests from your network (malware, an open proxy, a rented device) would help stop the attack at its source. \| path: /marque/2-scott \| query: order=product.position.asc&productListView=list&q=Cat%C3%A9gories-Femme \| 2026-09-23 21:27 UTC show less	DDoS Attack Web App Attack
🇺🇸 鬼影233	2026-09-21 06:40:26 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-20 17:57:56 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-19 19:09:42 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 Zandro	2026-08-23 13:00:14 (1 month ago)	distributed harvester	DDoS Attack Bad Web Bot Exploited Host
🇺🇸 TPI-Abuse	2025-12-31 11:01:43 (9 months ago)	(mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcas ... show more (mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 31 06:01:38.145043 2025] [security2:error] [pid 26237:tid 26237] [client 98.198.231.166:59428] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|scotts.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scotts.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aVUCknSV_tgJo4yCM9a9JgAAAAw"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-30 10:07:15 (10 months ago)	(mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcas ... show more (mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 05:07:10.638606 2025] [security2:error] [pid 9948:tid 9948] [client 98.198.231.166:44418] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|f4fbbs.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "f4fbbs.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSwXTjIAkIoWDcZkNxZw3wAAACI"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-29 00:19:38 (10 months ago)	(mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcas ... show more (mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 19:19:31.911711 2025] [security2:error] [pid 2470:tid 2470] [client 98.198.231.166:44640] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|vaezi.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vaezi.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSo8E_uuKyCtlfPSvC0MLwAAABE"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-28 11:20:40 (10 months ago)	(mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcas ... show more (mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 06:20:32.940397 2025] [security2:error] [pid 18363:tid 18363] [client 98.198.231.166:52820] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|hshr.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hshr.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSmFgHuzLUMvPUzm4VU8LwAAAAI"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-28 10:50:50 (10 months ago)	(mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcas ... show more (mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 05:50:46.812883 2025] [security2:error] [pid 20520:tid 20520] [client 98.198.231.166:34488] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|robertwhitbeck.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "robertwhitbeck.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSl-hjvlPxLzttAyib7dOwAAABA"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 voormedia	2025-11-27 22:10:58 (10 months ago)	Accessed trap at '/xmlrpc.php'	Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 21:00:29 (10 months ago)	(mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcas ... show more (mod_security) mod_security (id:225170) triggered by 98.198.231.166 (c-98-198-231-166.hsd1.tx.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:00:26.143606 2025] [security2:error] [pid 11096:tid 11096] [client 98.198.231.166:51962] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gadgeteer.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gadgeteer.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aSi76vsRKnI3BqGjDW7OdQAAAAo"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.208.49.250

🇺🇸 2a13:f42:e7b5:152d:5f81:8b8e:790e:f26c

🇨🇦 209.226.235.96

🇵🇱 194.180.49.68

🇵🇰 154.57.216.142

🇨🇳 106.13.161.135

🇨🇳 106.13.135.26

🇨🇳 106.13.124.251

🇨🇳 106.13.122.214

🇨🇳 106.13.122.198

🇷🇺 87.249.63.8

🇺🇸 34.207.143.80

🇧🇪 198.235.24.131

🇦🇷 186.39.77.178

🇺🇸 172.236.117.243

🇺🇸 172.234.222.249

🇭🇰 165.154.45.66

🇺🇸 162.216.149.84

🇫🇷 145.239.78.180

🇵🇰 144.48.130.143