Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show moreLarge-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /brands/shopby/manufacturer-nec-beyerdynamic-supermicro-lenovo-infocus-brother-clearone.html?dir=asc&order=most_viewed | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 | (Magento Site)
show less
Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x in AS203136 (LLC Ordunet), Georgia. On 2026-09-05 from 20:01 local time (+04:00) this host received 1,231,350 packets/sec, of which 1,220,538 packets/sec were discarded at our bord ...
show moreBotnet UDP flood (DDoS) against a hosted game server at 185.143.177.x in AS203136 (LLC Ordunet), Georgia. On 2026-09-05 from 20:01 local time (+04:00) this host received 1,231,350 packets/sec, of which 1,220,538 packets/sec were discarded at our border - the largest attack we have recorded. The flood hit udp 4444, 44444 and 80 simultaneously from 2412 distinct sources in 1091 networks and 125 countries; small uniform UDP datagrams of 29-48 bytes, a pure packet-rate attack. This source sustained more than 600 packets/sec toward the host, against about 200 packets/sec for a legitimate player. Detected on a MikroTik RouterOS router by per-source rate accounting in the raw/prerouting chain (dst-limit 600,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - the host is almost certainly compromised. Evidence on request to [email protected].
show less
