2026-11-10 22:19:02
UTC ·
(2 days ago)
MikroTik Enterprise Honeypot
Port Scan
🇺🇸
NetVexor
2026-11-10 03:32:03
UTC ·
(3 days ago)
Attack source identified and submitted via NetVexor BGP Blackhole Network
Port Scan
Hacking
Brute-Force
🇸🇬
ksi_digital
2026-11-10 00:01:00
UTC ·
(3 days ago)
Cowrie honeypot (telnet/23), 2026-11-10 00:01 UTC: 49 successful login(s) (user: admin,admin1,cht), then 515 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/sh ...
show more
Cowrie honeypot (telnet/23), 2026-11-10 00:01 UTC: 49 successful login(s) (user: admin,admin1,cht), then 515 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x57\x53\x4e\x57\x42\x4e'. Attempted payload fetch: http://192.176.50.190:59653/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
🇵🇱
MatStef132
2026-11-09 15:27:05
UTC ·
(4 days ago)
MatShield L7: blocked on unlocknow.cc (sec-ch-ua-on-non-chromium)
DDoS Attack
🇸🇬
ksi_digital
2026-11-09 00:01:00
UTC ·
(4 days ago)
Cowrie honeypot (telnet/23), 2026-11-09 00:01 UTC: 213 successful login(s) (user: !!Huawei,1234,666666), then 2097 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd / ...
show more
Cowrie honeypot (telnet/23), 2026-11-09 00:01 UTC: 213 successful login(s) (user: !!Huawei,1234,666666), then 2097 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x57\x53\x4e\x57\x42\x4e'. Attempted payload fetch: http://192.176.50.190:59653/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
🇸🇬
ksi_digital
2026-11-08 23:37:00
UTC ·
(4 days ago)
Cowrie honeypot (telnet/23), 2026-11-08 23:37 UTC: 136 successful login(s) (user: Administrator,admin,cht), then 1387 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&c ...
show more
Cowrie honeypot (telnet/23), 2026-11-08 23:37 UTC: 136 successful login(s) (user: Administrator,admin,cht), then 1387 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x57\x53\x4e\x57\x42\x4e'. Attempted payload fetch: http://192.176.50.190:59653/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
2026-11-06 10:06:24
UTC ·
(1 week ago)
ALFA Webshell Over HTTP.
Web App Attack
🇺🇸
knock
2026-11-05 23:41:38
UTC ·
(1 week ago)
Knock-Knock honeypot brute-force: Telnet (25 total hits)
Brute-Force
🇹🇷
oalver
2026-11-04 19:53:06
UTC ·
(1 week ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: honeypot_telnet. Sources: honeypot. First seen: 2026-11-04. Risk score: 90/100.
Brute-Force
IoT Targeted
🇦🇷
Bruno
2026-11-03 13:02:38
UTC ·
(1 week ago)
Port Scanner: 124.29.224.91
Port Scan
🇩🇪
KPS
2026-11-03 07:08:22
UTC ·
(1 week ago)
PortscanT
Port Scan
🇫🇷
security.rdmc.fr
2026-11-03 06:20:04
UTC ·
(1 week ago)
Port Scan Attack proto:TCP src:38515 dst:23
Port Scan
🇺🇸
LSPCCU
2026-11-02 18:54:18
UTC ·
(1 week ago)
TSEC Honeypot Network report. Threat score: 96/100. Categories: DDoS Attack, Port Scan, Hacking, Brute-Force, Exploited Host, Web App Attack, SSH, IoT Targeted. Honeypot: cowrie. Context: Attacker IP from Lahore, Pakistan (AS9541, Cyber Internet Serv ...
show more
TSEC Honeypot Network report. Threat score: 96/100. Categories: DDoS Attack, Port Scan, Hacking, Brute-Force, Exploited Host, Web App Attack, SSH, IoT Targeted. Honeypot: cowrie. Context: Attacker IP from Lahore, Pakistan (AS9541, Cyber Internet Services (Pvt) Ltd.
show less
DDoS Attack
Port Scan
Hacking
Brute-Force
Exploited Host
Web App Attack
SSH
IoT Targeted
🇺🇸
xmission.com
2026-11-01 20:26:24
UTC ·
(1 week ago)
Blocked by UFW (TCP on 23)
Source port: 38556
TTL: 45
Packet length: 40
TOS: 0x00
This report (for 124.29.224.91) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
Hacking
Brute-Force
🇺🇸
itsnixk
2026-10-31 17:39:14
UTC ·
(1 week ago)
(mod_security) mod_security (id:920280) triggered by 124.29.224.91 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 13:39:10.137495 2026] [security2:error] [pid 2179402:tid 2179548] [client ...
show more
(mod_security) mod_security (id:920280) triggered by 124.29.224.91 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 13:39:10.137495 2026] [security2:error] [pid 2179402:tid 2179548] [client 124.29.224.91:38945] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/setup.cgi"] [unique_id "auYnvkqcS014gWZIigU5-AAAAD8"]
show less
Port Scan
