2026-11-05 09:15:03
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /multimedia/display/shopby/screensize-40-47-55-52-85.html?p=4 | UA: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/47.0.845.0 Safari/535.1 | (Magento Site)
show less
Hacking
Bad Web Bot
🇮🇩
sockominfo
2026-08-19 14:00:53
UTC ·
(2 months ago)
User login to application from malicious IP 118.99.80.2.. Threat Score: 3.7/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network C ...
show more
User login to application from malicious IP 118.99.80.2.. Threat Score: 3.7/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-08-19 13:00:53
UTC ·
(2 months ago)
User login to application from malicious IP 118.99.80.2.. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network C ...
show more
User login to application from malicious IP 118.99.80.2.. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-08-19 12:00:09
UTC ·
(2 months ago)
User login to application from malicious IP 118.99.80.2.. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT
Hacking
Web App Attack
🇺🇸
kosada.com
2026-07-27 07:22:44
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-14 09:05:25
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
kernel-error.de
2026-02-18 08:15:32
UTC ·
(8 months ago)
Feb 18 09:10:57 ns1 sshd-session[86575]: Invalid user webuser from 118.99.80.2 port 23942
Feb 18 09:10:57 ns1 sshd-session[86575]: Received disconnect from 118.99.80.2 port 23942:11: Bye Bye [preauth]
Feb 18 09:12:24 ns1 sshd-session[86585]: Received ...
show more
Feb 18 09:10:57 ns1 sshd-session[86575]: Invalid user webuser from 118.99.80.2 port 23942
Feb 18 09:10:57 ns1 sshd-session[86575]: Received disconnect from 118.99.80.2 port 23942:11: Bye Bye [preauth]
Feb 18 09:12:24 ns1 sshd-session[86585]: Received disconnect from 118.99.80.2 port 23983:11: Bye Bye [preauth]
Feb 18 09:13:16 ns1 sshd-session[86587]: Received disconnect from 118.99.80.2 port 23346:11: Bye Bye [preauth]
Feb 18 09:14:10 ns1 sshd-session[86591]: Invalid user TEST from 118.99.80.2 port 22026
...
show less
Brute-Force
SSH
🇰🇿
188 188
2026-01-12 00:28:54
UTC ·
(10 months ago)
SSH brute force attack from 118.99.80.2
SSH
🇮🇹
sh97
2026-01-11 09:57:22
UTC ·
(10 months ago)
IT01-SF: SSH Brute Force from 118.99.80.2 at 2026-01-11 15:27:21 IST
Brute-Force
SSH
🇫🇷
SpaceHost-Server
2026-01-02 23:27:49
UTC ·
(10 months ago)
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2025-12-31 23:28:42
UTC ·
(10 months ago)
Brute-Force
Web App Attack
🇨🇱
iwunkhaus
2025-12-31 20:58:43
UTC ·
(10 months ago)
2025-12-31T20:52:15.503642+00:00 mx sshd[1925376]: Invalid user admin from 118.99.80.2 port 2904
2025-12-31T20:53:34.313184+00:00 mx sshd[1925496]: Invalid user deploy from 118.99.80.2 port 7125
2025-12-31T20:58:42.225894+00:00 mx sshd[1926009]: Inva ...
show more
2025-12-31T20:52:15.503642+00:00 mx sshd[1925376]: Invalid user admin from 118.99.80.2 port 2904
2025-12-31T20:53:34.313184+00:00 mx sshd[1925496]: Invalid user deploy from 118.99.80.2 port 7125
2025-12-31T20:58:42.225894+00:00 mx sshd[1926009]: Invalid user debian from 118.99.80.2 port 17511
...
show less
Brute-Force
SSH
🇫🇷
jymeo.com
2025-12-31 20:28:38
UTC ·
(10 months ago)
2025-12-31T20:27:53.046166+00:00 prod-westeu sshd[2342460]: Failed password for root from 118.99.80.2 port 1706 ssh2
2025-12-31T20:28:35.811343+00:00 prod-westeu sshd[2342634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ss ...
show more
2025-12-31T20:27:53.046166+00:00 prod-westeu sshd[2342460]: Failed password for root from 118.99.80.2 port 1706 ssh2
2025-12-31T20:28:35.811343+00:00 prod-westeu sshd[2342634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.80.2 user=root
2025-12-31T20:28:37.738181+00:00 prod-westeu sshd[2342634]: Failed password for root from 118.99.80.2 port 11777 ssh2
...
show less
Brute-Force
SSH
🇺🇸
bigscoots.com
2025-12-31 20:27:21
UTC ·
(10 months ago)
118.99.80.2 (ID/Indonesia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Dec 31 14:14:04 14214 sshd[9793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid ...
show more
118.99.80.2 (ID/Indonesia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Dec 31 14:14:04 14214 sshd[9793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.5.135 user=root
Dec 31 14:25:07 14214 sshd[10759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.80.2 user=root
Dec 31 14:25:09 14214 sshd[10759]: Failed password for root from 118.99.80.2 port 8268 ssh2
Dec 31 14:27:15 14214 sshd[10939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.80.2 user=root
Dec 31 14:27:17 14214 sshd[10939]: Failed password for root from 118.99.80.2 port 5588 ssh2
IP Addresses Blocked:
165.227.5.135 (US/United States/addressforall.org)
show less
Brute-Force
SSH
🇺🇸
bigscoots.com
2025-12-31 19:21:28
UTC ·
(10 months ago)
118.99.80.2 (ID/Indonesia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Dec 31 19:20:31 24569 sshd[19658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eui ...
show more
118.99.80.2 (ID/Indonesia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Dec 31 19:20:31 24569 sshd[19658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.71.52.51 user=root
Dec 31 19:20:33 24569 sshd[19658]: Failed password for root from 34.71.52.51 port 37724 ssh2
Dec 31 19:21:09 24569 sshd[19726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.134.203.156 user=root
Dec 31 19:20:48 24569 sshd[19662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.80.2 user=root
Dec 31 19:20:49 24569 sshd[19662]: Failed password for root from 118.99.80.2 port 8615 ssh2
IP Addresses Blocked:
34.71.52.51 (US/United States/51.52.71.34.bc.googleusercontent.com)
36.134.203.156 (CN/China/-)
show less
Brute-Force
SSH
