2026-11-14 07:15:05
UTC ·
(11 hours ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /brands/shopby/manufacturer-aten-rcf-realtronix-avaya-lsi-ask_proxima-xyz.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-13 06:56:42
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 179.6.7.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:56:35.404220 2026] [security2:error] [pid 7916:tid 7953] [client 179.6.7.36:19570] ModSecuri ...
show more
(mod_security) mod_security (id:210350) triggered by 179.6.7.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:56:35.404220 2026] [security2:error] [pid 7916:tid 7953] [client 179.6.7.36:19570] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||8mm-stockfootage.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "8mm-stockfootage.com"] [uri "/"] [unique_id "ava0o-IiGqn9ORYLBtKg7AAAAgA"], referer: https://alexlogic.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 04:38:48
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 179.6.7.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 00:38:42.715125 2026] [security2:error] [pid 10811:tid 10811] [client 179.6.7.36:37441] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 179.6.7.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 00:38:42.715125 2026] [security2:error] [pid 10811:tid 10811] [client 179.6.7.36:37441] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||unitoolsupplies.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "unitoolsupplies.com"] [uri "/"] [unique_id "aubCUiqdc0JdlcHwFCsz4AAAAAg"], referer: https://each.co.in/redirect.php?ref_host=tricolaoficial.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-31 02:10:03
UTC ·
(2 weeks ago)
Search protection: noref on category: 2 filter groups with no referrer of the shop (counts from 2) / reCAPTCHA challenge timed out
Bad Web Bot
2026-10-10 14:58:13
UTC ·
(1 month ago)
apache vulnerability scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 05:18:58
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 179.6.7.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:18:50.059664 2026] [security2:error] [pid 18098:tid 18098] [client 179.6.7.36:44973] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 179.6.7.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:18:50.059664 2026] [security2:error] [pid 18098:tid 18098] [client 179.6.7.36:44973] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||goatlick.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "goatlick.com"] [uri "/"] [unique_id "ar8-uhxDNYLkq7cqH2IGaAAAACE"], referer: https://agencylinkbuilding.store/dir/seo-outreach-backlinks-83258
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
RAP
2026-10-01 19:30:52
UTC ·
(1 month ago)
2026-10-01 19:30:52 UTC Unauthorized activity to TCP port 22. SSH
SSH
2026-10-01 13:32:16
UTC ·
(1 month ago)
suricata IPS/IDS detection, ruleset ET SCAN Potential SSH Scan
Port Scan
🇺🇸
鬼影233
2026-10-01 11:01:16
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇮🇩
Indobsd
2026-10-01 10:40:11
UTC ·
(1 month ago)
Port Scan
Web App Attack
SSH
🇺🇸
鬼影233
2026-09-30 18:57:47
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-30 13:42:01
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
Vegascosmetics
2026-09-27 11:51:11
UTC ·
(1 month ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB reputation policy (no URL signature). Evidence: Suspicion-Ban (Score 68>=65, Abuse 66, NonEU, first-seen, Change* path)
Hacking
Exploited Host
Web App Attack
🇪🇪
Tsumugi Kotobuki
2026-09-15 02:42:44
UTC ·
(1 month ago)
Port Scan on Honeypot | Ports: 22/SSH | Proto: TCP(1) | Flags: all SYN | TTL: 51 | Len: 60B | Win: 65535(1) | F2B/ufw-honeypot@2026-09-15T02:42:44Z
Port Scan
Hacking
🇫🇷
Entalpi.net
2026-09-14 21:53:52
UTC ·
(1 month ago)
Tried to hit sensible closed port commonly used in attacks
Port Scan
Hacking
