Anonymous
2026-11-08 14:15:03
UTC ·
(4 days ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Catalog Search Fake Parameter Blocked: /catalogsearch/result/?dir=asc&mode=list&order=relevance&q=nec+np403&screensize=17%2C22%2C47 | UA: Mozilla/5.0 (Android 2.2.3; Mobile; rv:33.0) Gecko/33.0 Firefox/33.0 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-02 16:58:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 179.63.242.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:58:49.620639 2026] [security2:error] [pid 1626832:tid 1626849] [client 179.63.242.172:42 ...
show more
(mod_security) mod_security (id:210350) triggered by 179.63.242.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:58:49.620639 2026] [security2:error] [pid 1626832:tid 1626849] [client 179.63.242.172:42496] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||attorneylouisiana.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "attorneylouisiana.com"] [uri "/"] [unique_id "aujBSV5VTbmti2zn0gEDoQAAAUw"], referer: https://agqo.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
security.rdmc.fr
2026-09-06 09:56:20
UTC ·
(2 months ago)
Port Scan Attack proto:TCP src:48374 dst:23
Port Scan
🇦🇹
urnilxfgbez
2026-09-02 22:45:00
UTC ·
(2 months ago)
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
Port Scan
🇧🇷
noconex
2026-09-02 19:39:13
UTC ·
(2 months ago)
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 179.63.242.172
Port Scan
Brute-Force
SSH
🇫🇷
EDSL
2026-09-02 06:41:22
UTC ·
(2 months ago)
[SRV-VPN1] Blocked by SysWarden Firewall (Telnet IoT Attack)
Brute-Force
IoT Targeted
Port Scan
🇺🇸
MPL
2026-09-02 03:13:16
UTC ·
(2 months ago)
tcp/22 (12 or more attempts)
Port Scan
🇦🇺
PetePK
2026-09-01 17:29:01
UTC ·
(2 months ago)
Probed 2 time(s): TCP/22, TCP/23
Port Scan
🇦🇺
PetePK
2026-09-01 16:59:06
UTC ·
(2 months ago)
Probed 1 time(s): TCP/22
Port Scan
🇳🇱
DrLex0
2026-09-01 08:15:47
UTC ·
(2 months ago)
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
179.63.242.172 443 - [01/Sep/2026:08:15:47 +0000] "GET [redacted] HTTP/1.1" 410 6143 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10 ...
show more
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
179.63.242.172 443 - [01/Sep/2026:08:15:47 +0000] "GET [redacted] HTTP/1.1" 410 6143 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
show less
Bad Web Bot
Exploited Host
🇬🇧
pufferfishenjoyer
2026-08-31 17:34:17
UTC ·
(2 months ago)
IP caught from endlessh logs
Brute-Force
SSH
🇺🇸
LockBlock
2026-08-30 22:31:53
UTC ·
(2 months ago)
2026-08-30 22:31:53: Port scan detected from 179.63.242.172 on port 22 of racknerd-e7e1a9
Port Scan
SSH
🇩🇪
london2038.com
2026-08-30 11:14:55
UTC ·
(2 months ago)
Connection atttempts against closed TCP ports
Aug 30 13:14:52 BLOCK SRC=179.63.242.172 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=15725 DF PROTO=TCP SPT=42824 DPT=22 WINDOW=65535 RES=0x00 SYN
Aug 30 13:14:53 BLOCK SRC=179.63.242.172 LEN=60 TOS=0x00 PREC=0x ...
show more
Connection atttempts against closed TCP ports
Aug 30 13:14:52 BLOCK SRC=179.63.242.172 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=15725 DF PROTO=TCP SPT=42824 DPT=22 WINDOW=65535 RES=0x00 SYN
Aug 30 13:14:53 BLOCK SRC=179.63.242.172 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=15726 DF PROTO=TCP SPT=42824 DPT=22 WINDOW=65535 RES=0x00 SYN
Aug 30 13:14:54 BLOCK SRC=179.63.242.172 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=15727 DF PROTO=TCP SPT=42824 DPT=22 WINDOW=65535 RES=0x00 SYN
show less
Port Scan
🇧🇷
noconex
2026-08-30 03:12:58
UTC ·
(2 months ago)
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 179.63.242.172
Port Scan
Brute-Force
SSH
🇺🇸
ShadowWhisperer
2026-08-29 18:21:55
UTC ·
(2 months ago)
TELNET port scan / probe. dropped before login
Port Scan
IoT Targeted