🇩🇪
LRob
2026-11-08 17:35:50
UTC ·
(1 day ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/e884061737482e780ea5df0c116b6b11658ebf03/packaging/deb/control | src_port: 55514 | ua: Mozilla/5.0 (Windows NT 10. ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/e884061737482e780ea5df0c116b6b11658ebf03/packaging/deb/control | src_port: 55514 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 | 2026-11-08 17:35 UTC
show less
DDoS Attack
Bad Web Bot
🇩🇪
nyuuzyou
2026-11-05 01:39:39
UTC ·
(4 days ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-05T01:39:39Z.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-29 07:39:50
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 154.27.156.1 (1.156.27.154.static.mds-telecom.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 03:39:46.097073 2026] [security2:error] [pid 22050:tid 2205 ...
show more
(mod_security) mod_security (id:210350) triggered by 154.27.156.1 (1.156.27.154.static.mds-telecom.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 03:39:46.097073 2026] [security2:error] [pid 22050:tid 22050] [client 154.27.156.1:53420] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bikiniadvice.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bikiniadvice.com"] [uri "/"] [unique_id "auL4QhmrI_iHVMdQu5mzRgAAAA8"], referer: https://five.co.in/redirect.php?ref_host=deovent.at
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 03:25:07
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 154.27.156.1 (1.156.27.154.static.mds-telecom.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 23:25:01.434918 2026] [security2:error] [pid 13024:tid 1302 ...
show more
(mod_security) mod_security (id:210350) triggered by 154.27.156.1 (1.156.27.154.static.mds-telecom.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 23:25:01.434918 2026] [security2:error] [pid 13024:tid 13024] [client 154.27.156.1:37348] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gazeboweddinginvitations.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gazeboweddinginvitations.com"] [uri "/"] [unique_id "ar8kDXRg4xX1CK_ktQzFWgAAAAM"], referer: https://onlinebacklinkcreator.space/dir/strong-domain-backlinks-79570
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-29 02:21:24
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-26 20:45:09
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
LRob
2026-09-26 13:06:37
UTC ·
(1 month ago)
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no b ...
show more
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no browser is behind them. Each participating address sends only one or two such requests, but we count them by the million: a botnet, compromised devices, or abused proxies. The address is blocked. An investigation into what exactly sends these requests from your network (malware, an open proxy, a rented device) would help stop the attack at its source. | path: /30-meilleur-velo-entre-2000-et-3000-euros | query: q=Famille-Crosshill-Xelius | 2026-09-26 13:06 UTC
show less
DDoS Attack
Web App Attack
🇺🇸
鬼影233
2026-09-21 19:26:37
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-20 17:44:38
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇩🇪
HandyTreff.de
2026-09-19 01:41:34
UTC ·
(1 month ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -68.763 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Sa
Web App Attack
Bad Web Bot
🇫🇷
wiredalter
2026-09-05 03:11:19
UTC ·
(2 months ago)
Blocked by fail2ban on o2VPS [22/tcp]
Source Port: 57090
TTL: 43
Packet Length: 60
TOS: 0x00
Analyzed by https://ip.wiredalter.com
Brute-Force
SSH
🇺🇸
RAP
2026-09-03 05:40:47
UTC ·
(2 months ago)
2026-09-03 05:40:47 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇧🇷
noconex
2026-09-02 19:53:08
UTC ·
(2 months ago)
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 154.27.156.1
Port Scan
Brute-Force
SSH
🇺🇸
鬼影233
2026-09-02 16:25:43
UTC ·
(2 months ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇷🇸
Scan
2026-09-02 01:33:15
UTC ·
(2 months ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
