128.201.119.79

Not following 301 redirects — wasted requests | method: GET | path: http://www.processcommunication.fr/collaborateur/1384 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36

Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Catalog Search Abuse Blocked: /catalogsearch/result/?cat=4&iptel_certified=185%2C187&product_vc_type=100&q=ex+90 | UA: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/4034-06-28 19:50:45.339661 Firefox/3.6.16 | (Magento Site) show less

Drop from IP address 128.201.119.79 to tcp-port 23

UDP flood (DDoS) vs AS215599: 42 pkts / 0.06 MB to UDP 80/8443 across 37 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host ... show more UDP flood (DDoS) vs AS215599: 42 pkts / 0.06 MB to UDP 80/8443 across 37 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less

UDP flood (DDoS) vs AS215599: 42 pkts / 0.06 MB to UDP 80/8443 across 37 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host ... show more UDP flood (DDoS) vs AS215599: 42 pkts / 0.06 MB to UDP 80/8443 across 37 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less

Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-08-19 21:25:21 UTC Log evidence: 08/19/2026-21:25:20.306062 [wDrop] [**] [1:7001101:1] FINSERV CRITICAL: Telnet Access Blocked [**] [Cl ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-08-19 21:25:21 UTC Log evidence: 08/19/2026-21:25:20.306062 [wDrop] [**] [1:7001101:1] FINSERV CRITICAL: Telnet Access Blocked [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 128.201.119.79:56279 -> 185.127.18.66:23 08/19/2026-21:25:20.306062 [**] [1:1000103:1] SECURITY Management Port Probe - CRITICAL [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 128.201.119.79:56279 -> 185.127.18.66:23 show less

tcp/23 (6 or more attempts)

AutoBlock: 📡 Port 22 Scan (Non Decay-Based)

Unauthorized connection to SSH port 22

Unauthorized connection to SSH port 22

denied traffic to a honeypot network. destination port 22.

128.201.119.79 | Port: 9298 | DNS: 128.201.119.79 2026-01-28T22:29:51+08:00 America/Santiago | Fake HTTP Protocol detected! | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 HTTP/1.1 ... show more 128.201.119.79 | Port: 9298 | DNS: 128.201.119.79 2026-01-28T22:29:51+08:00 America/Santiago | Fake HTTP Protocol detected! | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 HTTP/1.1 443 GET | URL: /tracking/?bf991c3f8054ade09824b3d9e7bbd6cc=1731125747 | Ref: - | Country: CL/Chile/-04:00 IP City: Molina macOS 9c512f2bf802d9f9-MIA/Miami, FL, United States 1 hits/0 secs Browser 2 show less

scanning http requests from known botnet

scanning http requests from known botnet