103.84.57.69

Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /communications/shopby/manufacturer-polycom-lifesize-aastra-audiocodes-netgear-hp-avaya-fortinet-revolabs-spectralink-unify.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | (Magento Site) show less

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0

Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp

Web bot: denial-of-service flood

Brute force SSH login attempts.

BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives 103.84.57.69 443 - [07/Aug/2026:04:17:14 +0000] "GET [redacted] HTTP/1.1" 200 6940 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_1 ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives 103.84.57.69 443 - [07/Aug/2026:04:17:14 +0000] "GET [redacted] HTTP/1.1" 200 6940 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" show less

Web bot: denial-of-service flood

Web bot: denial-of-service flood

Web bot: denial-of-service flood

(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security

Botnet or web spider not respecting robots.txt

Web App Attack

(mod_security) mod_security (id:217210) triggered by 103.84.57.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 19 23:51:32.530465 2026] [security2:error] [pid 1813522:tid 1813522] [client 103.84.57.69:49954] ... show more (mod_security) mod_security (id:217210) triggered by 103.84.57.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 19 23:51:32.530465 2026] [security2:error] [pid 1813522:tid 1813522] [client 103.84.57.69:49954] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||usa61pays.shop|F|4"] [data "GET http://usa61pays.shop HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "usa61pays.shop"] [uri "/"] [unique_id "aeWixBiTp64fcsUtAChH6wAAAAU"] show less

Botnet infected device observed in honeypot (Vector: TCP)