🇩🇪
Vegascosmetics
2026-10-18 14:47:23
(14 hours ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local blo ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (62, Abuse: 55)
show less
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:16:59
(23 hours ago)
(mod_security) mod_security (id:220150) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:220150) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:16:52.687217 2026] [security2:error] [pid 3175:tid 3175] [client 98.228.118.86:37130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:union(?:\\\\/\\\\*.{0,399}\\\\*\\\\/)?select)" at ARGS:filter. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5662"] [id "220150"] [rev "5"] [msg "COMODO WAF: SQL injection vulnerability in Ginkgo CMS 5.0 (CVE-2013-5318)||www.old.renju.net|F|2"] [data "')/**/and/**/('vbuanr'='vbuanr'/**/union/**/all/**/select/**/'mohwlodgfatdmbrraikxmskdajemohbh'--/**/pwn8ik"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.old.renju.net"] [uri "/people/fuseki_stat.php"] [unique_id "atRkVNNGJrSyN3dRzLEmCgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-10-15 00:35:08
(4 days ago)
98.228.118.86 - - [15/Oct/2026:00:34:26 +0000] "GET /?author=2&feed=rss2 HTTP/2.0" 403 1033 "-" "Moz ...
show more
98.228.118.86 - - [15/Oct/2026:00:34:26 +0000] "GET /?author=2&feed=rss2 HTTP/2.0" 403 1033 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" "-" edge="98.228.118.86"
98.228.118.86 - - [15/Oct/2026:00:34:27 +0000] "GET /?author=3&feed=rss2 HTTP/2.0" 403 1033 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" "-" edge="98.228.118.86"
98.228.118.86 - - [15/Oct/2026:00:34:27 +0000] "GET /?author=4&feed=rss2 HTTP/2.0" 403 1033 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" "-" edge="98.228.118.86"
98.228.118.86 - - [15/Oct/2026:00:34:28 +0000] "GET /?author=5&feed=rss2 HTTP/2.0" 403 1033 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" "-" edge="98.228.118.86"
98.228.118.86 - - [15/Oct/2026:00:34:33 +0000] "GET /?author
...
show less
Web App Attack
🇫🇷
masterguru
2026-10-13 11:56:33
(5 days ago)
(modsec_5040) ModSec 5040: API Basic Auth blocked from 98.228.118.86 (US/United States/-): 1 in the ...
show more
(modsec_5040) ModSec 5040: API Basic Auth blocked from 98.228.118.86 (US/United States/-): 1 in the last 3600 secs (0-195)
show less
Hacking
2026-10-13 05:52:02
(5 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 05:33:56
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:33:52.518895 2026] [security2:error] [pid 7402:tid 7419] [client 98.228.118.86:44226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||quantumgaze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "quantumgaze.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "asxxQCw7e2ER0A2bbZmvGQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-10-12 00:15:25
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇲🇽
octageeks.com
2026-10-10 04:50:28
(1 week ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇩🇪
netclix.gr
2026-10-10 01:12:46
(1 week ago)
(wordpress) Failed wordpress login from 98.228.118.86 (US/United States/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-10-09 15:22:52
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 11:22:46.637414 2026] [security2:error] [pid 8834:tid 8834] [client 98.228.118.86:44098] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wp.hotpay.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wp.hotpay.co"] [uri "/wp-json/wp/v2/users/me"] [unique_id "askGxvTIoxss0CpV9-rD5QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 08:55:27
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 04:55:20.247693 2026] [security2:error] [pid 6419:tid 6419] [client 98.228.118.86:39740] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||healingworksmassage.studio|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "healingworksmassage.studio"] [uri "/wp-json/wp/v2/users"] [unique_id "ar9xeBQQEwveQ1jXNTxf7QAAAAs"], referer: https://healingworksmassage.studio/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
edgeshield
2026-09-26 18:30:40
(3 weeks ago)
Automated web request flooding / DDoS (EdgeShield WAF).
DDoS Attack
🇦🇺
AWW-Admin
2026-09-16 13:13:12
(1 month ago)
(pop3d) Failed POP3 login from 98.228.118.86 (US/United States/-)
Brute-Force
🇮🇩
sockominfo
2026-09-14 16:01:01
(1 month ago)
Email: Login failures from Bad Reputation IP: 98.228.118.86. Threat Score: 6.3/10 (MEDIUM). Confiden ...
show more
Email: Login failures from Bad Reputation IP: 98.228.118.86. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 75%. MITRE ATT&CK: T1566 (Phishing). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 18:55:19
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 98.228.118.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 14:55:11.192956 2026] [security2:error] [pid 25651:tid 25651] [client 98.228.118.86:38544] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||elgar.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "elgar.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqBaD_4JKXtcmbUziuyDkgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
