🇩🇪
LRob
2026-11-08 08:39:46
UTC ·
(4 days ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/0565e210880499e1c06a5427c4b3369e959b903c/internal/reporting/reporting.go | src_port: 18975 | ua: Mozilla/5.0 (Wind ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/0565e210880499e1c06a5427c4b3369e959b903c/internal/reporting/reporting.go | src_port: 18975 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇫🇮
pavel Karpenko
2026-10-27 02:18:38
UTC ·
(2 weeks ago)
125.212.159.213 - - [27/Oct/2026:05:18:38 +0300] "GET /property_org.php?org_id=ORG-MU92-RIPE&lang=ru HTTP/1.1" 404 218 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" client_ ...
show more
125.212.159.213 - - [27/Oct/2026:05:18:38 +0300] "GET /property_org.php?org_id=ORG-MU92-RIPE&lang=ru HTTP/1.1" 404 218 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" client_port=2080 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1793067518.139
show less
DDoS Attack
🇫🇷
Tilellit.PRO
2026-09-19 05:56:55
UTC ·
(1 month ago)
WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-18 20:15:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 125.212.159.213 (dynamic-ip-adsl.viettel.vn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 16:14:47.334244 2026] [security2:error] [pid 22558:tid 22558] [cl ...
show more
(mod_security) mod_security (id:210730) triggered by 125.212.159.213 (dynamic-ip-adsl.viettel.vn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 16:14:47.334244 2026] [security2:error] [pid 22558:tid 22558] [client 125.212.159.213:22915] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cottrellfamily.com.cottrel.com|F|2"] [data ".mdb"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cottrellfamily.com.cottrel.com"] [uri "/htdocs/users.mdb"] [unique_id "aq2btz17b-TR3HtIz_h6qQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-05 03:31:02
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇫🇷
MatStef132
2026-06-21 21:27:03
UTC ·
(4 months ago)
MatShield L7: blocked on mathost.eu (ua-quarantined)
Bad Web Bot
🇫🇷
Sklurk
2026-06-16 02:21:02
UTC ·
(4 months ago)
Web App Attack
Web App Attack
🇩🇪
Inamin
2026-06-15 04:07:02
UTC ·
(4 months ago)
125.212.159.213 - - [15/Jun/2026:09:42:08 +0800] "GET /index.php?action=history&title=%E3%82%A8%E3%83%9E%E3%83%BB%E3%83%B4%E3%82%A7%E3%83%AB%E3%83%87%2F%E6%95%85%E4%BA%8B%2FZH%2F%E7%AC%AC21%E8%A9%B1_%E8%B8%8F%E4%B8%8A%E5%90%84%E8%87%AA%E7%9A%84%E6%96 ...
show more
125.212.159.213 - - [15/Jun/2026:09:42:08 +0800] "GET /index.php?action=history&title=%E3%82%A8%E3%83%9E%E3%83%BB%E3%83%B4%E3%82%A7%E3%83%AB%E3%83%87%2F%E6%95%85%E4%BA%8B%2FZH%2F%E7%AC%AC21%E8%A9%B1_%E8%B8%8F%E4%B8%8A%E5%90%84%E8%87%AA%E7%9A%84%E6%96%B0%E6%97%85%E7%A8%8B HTTP/2.0" 502 559 "-" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/5.1)"
125.212.159.213 - - [15/Jun/2026:12:07:02 +0800] "GET /api.php?action=feedrecentchanges&days=7&feedformat=atom&hidebots=1&limit=50&target=%E3%82%B9%E3%83%88%E3%83%BC%E3%83%AA%E3%83%BC%2F%E3%82%B0%E3%83%AB%E3%83%BC%E3%83%97%C3%B7%E5%80%8B%E6%80%A7%C3%97%E9%AD%85%E5%8A%9B%EF%BC%9D%EF%BC%9F%2FEN&urlversion=1&userExpLevel=registered HTTP/2.0" 502 559 "-" "Mozilla/5.0 (compatible; MSIE 5.0; Windows NT 5.01; Trident/3.1)"
...
show less
Brute-Force
🇫🇷
bigorre.org
2026-05-20 15:04:07
UTC ·
(5 months ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇩🇪
ghostwarriors
2026-04-07 06:21:11
UTC ·
(7 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-12-23 17:20:27
UTC ·
(10 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇺🇸
RAP
2025-01-12 01:32:05
UTC ·
(1 year ago)
2025-01-12 01:32:05 UTC Unauthorized activity to TCP port 445. SMB
Port Scan
2024-10-24 12:38:26
UTC ·
(2 years ago)
Unauthorized connection to SMB port 445
Port Scan
2024-08-10 04:18:05
UTC ·
(2 years ago)
Ports: 25,587,465; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-08-08 07:32:08
UTC ·
(2 years ago)
Ports: 25,2525,110,143,993,995; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
