160.20.85.159

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36

31001/udp (1 or more attempts)

Unauthorized connection to MySQL port 3306

denied traffic to a non-approved destination port. destination port 52125.

Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x in AS203136 (LLC Ordunet), Georgia. On 2026-09-05 from 20:01 local time (+04:00) this host received 1,231,350 packets/sec, of which 1,220,538 packets/sec were discarded at our bord ... show more Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x in AS203136 (LLC Ordunet), Georgia. On 2026-09-05 from 20:01 local time (+04:00) this host received 1,231,350 packets/sec, of which 1,220,538 packets/sec were discarded at our border - the largest attack we have recorded. The flood hit udp 4444, 44444 and 80 simultaneously from 2412 distinct sources in 1091 networks and 125 countries; small uniform UDP datagrams of 29-48 bytes, a pure packet-rate attack. This source sustained more than 600 packets/sec toward the host, against about 200 packets/sec for a legitimate player. Detected on a MikroTik RouterOS router by per-source rate accounting in the raw/prerouting chain (dst-limit 600,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - the host is almost certainly compromised. Evidence on request to [email protected]. show less

Blocked by UFW (TCP on 9101) Source port: 43074 TTL: 109 Packet length: 52 TOS: 0x08 This report (for 160.20.85.159) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

Blocked by UFW (TCP on 9101) Source port: 43214 TTL: 109 Packet length: 52 TOS: 0x08 This report (for 160.20.85.159) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

Blocked by UFW (TCP on 9101) Source port: 43314 TTL: 109 Packet length: 52 TOS: 0x08 This report (for 160.20.85.159) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

Large-scale coordinated botnet (2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature Bl ... show more Large-scale coordinated botnet (2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/add/product/13467/form_key/bl967k9j7kM8TRqS/ | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows 98; Trident/4.0) | (Magento Site) show less

Unauthorized connection attempt

FW-PortScan: Traffic Blocked srcport=3711 dstport=65356

Unauthorized connection attempt

🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27

scanning http requests from known botnet