2026-11-05 05:15:03
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Blocked by User-Agent Filter (Bad Bot Pattern: MSIE 6.): Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.01; Trident/5.0) | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.01; Trident/5.0) | (Magento Site)
show less
Hacking
Bad Web Bot
🇫🇷
pyrogoto
2026-11-04 04:27:29
UTC ·
(1 week ago)
Do not respect robots.txt
Bad Web Bot
🇩🇪
nyuuzyou
2026-09-09 21:27:41
UTC ·
(2 months ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-09-09T21:27:41Z.
Bad Web Bot
🇩🇪
ghostwarriors
2026-08-30 10:20:31
UTC ·
(2 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-08-30 10:03:24
UTC ·
(2 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇩🇪
FD-IX
2026-08-30 10:01:55
UTC ·
(2 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-08-14 09:50:10
UTC ·
(3 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-14 09:25:40
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 05:25:31.045121 2026] [security2:error] [pid 25564:tid 25564] [client 111.92.145.102:57915] ...
show more
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 05:25:31.045121 2026] [security2:error] [pid 25564:tid 25564] [client 111.92.145.102:57915] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 111.92.145.102 (+1 hits since last alert)|modmove.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "modmove.com"] [uri "/xmlrpc.php"] [unique_id "an7fC8AjzgLEFh7e_b4dcQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-08-14 09:22:58
UTC ·
(3 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-14 09:14:34
UTC ·
(3 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
LRob
2026-08-14 07:56:49
UTC ·
(3 months ago)
WordPress probing | req: /xmlrpc.php | UA: Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 17:58:52
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 13:58:44.602366 2026] [security2:error] [pid 9426:tid 9426] [client 111.92.145.102:39308] M ...
show more
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 13:58:44.602366 2026] [security2:error] [pid 9426:tid 9426] [client 111.92.145.102:39308] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 111.92.145.102 (+1 hits since last alert)|lasertherapyoc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lasertherapyoc.com"] [uri "/xmlrpc.php"] [unique_id "alEy1Ex3P-l6jSEit2WHjAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 16:56:21
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 12:56:13.654982 2026] [security2:error] [pid 32692:tid 32692] [client 111.92.145.102:39199] ...
show more
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 12:56:13.654982 2026] [security2:error] [pid 32692:tid 32692] [client 111.92.145.102:39199] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 111.92.145.102 (+1 hits since last alert)|thinkingepic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thinkingepic.com"] [uri "/xmlrpc.php"] [unique_id "alEkLSc2-LFUV79t4wjlDQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 16:27:23
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 12:27:15.303398 2026] [security2:error] [pid 1731:tid 1731] [client 111.92.145.102:39328] M ...
show more
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 12:27:15.303398 2026] [security2:error] [pid 1731:tid 1731] [client 111.92.145.102:39328] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 111.92.145.102 (+1 hits since last alert)|infinityartistsgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "infinityartistsgroup.com"] [uri "/xmlrpc.php"] [unique_id "alEdY9T2QQDZieElWQbybwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 16:06:05
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 12:05:59.357670 2026] [security2:error] [pid 5164:tid 5164] [client 111.92.145.102:39551] M ...
show more
(mod_security) mod_security (id:240335) triggered by 111.92.145.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 12:05:59.357670 2026] [security2:error] [pid 5164:tid 5164] [client 111.92.145.102:39551] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 111.92.145.102 (+1 hits since last alert)|darkalleyproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "darkalleyproductions.com"] [uri "/xmlrpc.php"] [unique_id "alEYZwwv3oS7lleS8HTm-AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
