🇬🇧
nandadytm
2026-11-14 16:36:41
UTC ·
(11 hours ago)
[2026-11-14 16:36:41] Banned 138.36.150.49 after 3 attempts: Portscan probe on TCP port 22
Port Scan
2026-11-07 02:15:03
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /communications/shopby/manufacturer-audiocodes-snom-hp-crestron-bosch-dis-rcf-sony-avaya-ruckus-xclaim-huawei-revolabs-spectralink.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
RAP
2026-10-08 16:11:14
UTC ·
(1 month ago)
2026-10-08 16:11:14 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇺🇸
RAP
2026-08-19 04:04:44
UTC ·
(2 months ago)
2026-08-19 04:04:44 UTC Unauthorized activity to TCP port 22. SSH
SSH
2026-08-18 04:58:00
UTC ·
(2 months ago)
denied SSH access attempt. destination port 22.
Port Scan
Brute-Force
SSH
🇩🇪
filstal.org
2026-08-08 00:01:38
UTC ·
(3 months ago)
Automated bot: spoofed/impossible user-agent, web scraping or automated request patterns detected. UA: Mozilla/5.0 (Linux; Android 4.1) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/49.0.889.0 Safari/534.2
Bad Web Bot
Web App Attack
🇺🇸
stechusa
2026-07-08 06:16:51
UTC ·
(4 months ago)
ELEVATED_THREAT | 361 IPs targeting /brand.html | URL template shared by 11 IPs: /brand.html?bulb_shape=*&bulb_base=*&bulb_type=*&mode=list&p=* | Facet request during elevated threat (facet_ratio=0.97, unique_ips=567)
Bad Web Bot
DDoS Attack
🇵🇱
sefinek.net
2026-06-06 00:05:54
UTC ·
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from AR.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: /genshin-stella-mod/gallery/compare/v600...v610 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ...
show more
Triggered Cloudflare WAF (firewallCustom) from AR.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: /genshin-stella-mod/gallery/compare/v600...v610 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Brave Chrome/80.0.3987.162 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-04-03 22:02:58
UTC ·
(7 months ago)
138.36.150.49 (AR/Argentina/Buenos Aires/San Miguel/pppoe-49.150.36.138.in-addr.arpa/[redacted]
Brute-Force
🇺🇸
TPI-Abuse
2026-02-15 09:33:14
UTC ·
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 138.36.150.49 (pppoe-49.150.36.138.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 04:33:10.857840 2026] [security2:error] [pid 13371:tid 13371] ...
show more
(mod_security) mod_security (id:210730) triggered by 138.36.150.49 (pppoe-49.150.36.138.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 04:33:10.857840 2026] [security2:error] [pid 13371:tid 13371] [client 138.36.150.49:52106] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||disabilitiestravel.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "disabilitiestravel.com"] [uri "/amazon/WS_FTP.LOG"] [unique_id "aZGS1u6lxmhzz7DTB9et_wAAABA"], referer: http://disabilitiestravel.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-28 16:57:20
UTC ·
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 138.36.150.49 (pppoe-49.150.36.138.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 11:57:02.885486 2025] [security2:error] [pid 10699:tid 10699] ...
show more
(mod_security) mod_security (id:210350) triggered by 138.36.150.49 (pppoe-49.150.36.138.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 11:57:02.885486 2025] [security2:error] [pid 10699:tid 10699] [client 138.36.150.49:40192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.thenowhere-men.theillustrator.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.thenowhere-men.theillustrator.net"] [uri "/"] [unique_id "aVFhXsdtrvUvryvbuNoD_gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-09-21 17:39:45
UTC ·
(1 year ago)
Unauthorized connection attempt on Port 23
Port Scan
Hacking
Exploited Host
