🇩🇪
Vegascosmetics
2026-06-17 22:31:29
(3 days ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security
DDoS Attack
Hacking
Exploited Host
🇮🇹
A000Z
2026-05-16 11:20:41
(1 month ago)
Fail2Ban: 103.190.40.167 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5 ...
show more
Fail2Ban: 103.190.40.167 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.1392.1405 Safari/537.36
show less
Bad Web Bot
🇩🇪
phil2k
2026-04-15 20:51:00
(2 months ago)
Fail2ban: Within 2026-04-13 12:14:14 - 2026-04-13 12:19:23 CEST(+0200) banned: 17 times by fail2ban[ ...
show more
Fail2ban: Within 2026-04-13 12:14:14 - 2026-04-13 12:19:23 CEST(+0200) banned: 17 times by fail2ban[<MDA>]; 17 times by fail2ban[<MDA>2]; 17 times by fail2ban[<MTA>-sasl]; 17 times by fail2ban[<MTA>]; 17 times by fail2ban[recidive]; 17 times by fail2ban[<MTA>-ddos]
show less
Brute-Force
Email Spam
DDoS Attack
🇩🇪
phil2k
2026-04-13 10:14:23
(2 months ago)
fail2ban:<MDA>:2026-04-13T12:14:14.256041+02:00 <SRV> <MDA>: auth-worker(460849): conn unix:auth-wor ...
show more
fail2ban:<MDA>:2026-04-13T12:14:14.256041+02:00 <SRV> <MDA>: auth-worker(460849): conn unix:auth-worker (pid=460848,uid=108): auth-worker<1>: sql(catalin@<ANONYMIZED_DOMAIN>,103.190.40.167): unknown user
2026-04-13T12:14:21.025705+02:00 <SRV> <MDA>: auth: sql(catalin@<ANONYMIZED_DOMAIN>,103.190.40.167): unknown user
show less
Port Scan
Brute-Force
Email Spam
🇫🇷
SpaceHost-Server
2026-04-12 17:39:25
(2 months ago)
Apr 12 19:39:23 dev postfix/smtpd[3831982]: warning: unknown[103.190.40.167]: SASL CRAM-MD5 authenti ...
show more
Apr 12 19:39:23 dev postfix/smtpd[3831982]: warning: unknown[103.190.40.167]: SASL CRAM-MD5 authentication failed: authentication failure, [email protected]
Apr 12 19:39:23 dev postfix/smtpd[3831982]: warning: unknown[103.190.40.167]: SASL PLAIN authentication failed: authentication failure, [email protected]
Apr 12 19:39:24 dev postfix/smtpd[3831982]: warning: unknown[103.190.40.167]: SASL LOGIN authentication failed: authentication failure, [email protected]
show less
Hacking
Brute-Force
🇮🇹
Progetto1
2026-04-12 08:35:02
(2 months ago)
Mail - Multiple failed login attempts
Brute-Force
Exploited Host
2026-04-12 08:21:10
(2 months ago)
BruteForce IMAP/POP3/SMTP
Brute-Force
🇵🇦
iphezimbra
2026-04-12 08:11:22
(2 months ago)
Fail2Ban reported IP from jail zimbra-smtp on <hostname>
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-03-11 04:22:52
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 103.190.40.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 103.190.40.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 00:22:43.647637 2026] [security2:error] [pid 25281:tid 25281] [client 103.190.40.167:5144] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||borzois.com|F|2"] [data ".batw.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "borzois.com"] [uri "/www.BATW.com"] [unique_id "abDuE0qTRsj4PWw1WBAPMQAAAAk"], referer: http://borzois.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-02-28 05:17:41
(3 months ago)
Cloudflare WAF: Request Path: / Request Query: ?cat=-1%27%29%2F%2A%2150000AND%2A%2F%28%2F%2A%2150000 ...
show more
Cloudflare WAF: Request Path: / Request Query: ?cat=-1%27%29%2F%2A%2150000AND%2A%2F%28%2F%2A%2150000SELECT%2A%2F2%2A%28IF%28%28%2F%2A%2150000SELECT%2A%2F%2A%2F%2A%2150000FROM%2A%2F%28%2F%2A%2150000SELECT%2A%2F%2F%2A%2150000CONCAT%2A%2F%28%2527~%2527%2C%28%2F%2A%2150000SELECT%2A%2F%28ELT%289229%3D9229%2C1%29%29%29%2C%2527~%2527%2C%2527x%2527%29%29s%29%2C%2F%2A%2A%2F8446744073709551610%2C%2F%2A%2A%2F8446744073709551610%29%29%29+AND+%28%27ydLuh80m%27+LIKE+%27ydLuh80m Host: hwagm.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Action: block Source: firewallManaged ASN Description: DMNPL-AS-AP DISH MEDIA NETWORK PUBLIC LIMITED Country: NP Method: GET Timestamp: 2026-02-28T05:17:41Z ruleId: 8629bb58defe4193ab4d493c7bd2d8fa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇳🇱
exxos
2025-08-31 17:03:01
(9 months ago)
Attacks with Bad user agents
Hacking
🇪🇸
Global Cyber Police
2025-07-28 10:00:51
(10 months ago)
Malicious bot activity detected: Hitting honeypot page. Part of massive botnet.
DDoS Attack
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Web App Attack
2025-03-27 01:59:26
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-02-04 05:26:37
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH