2026-11-09 11:07:07
UTC ·
(7 hours ago)
WEB attack
Brute-Force
2026-11-07 03:15:04
UTC ·
(2 days ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /communications/shopby/manufacturer-cisco-polycom-aastra-audiocodes-snom-netgear-hp-crestron-dis-beyerdynamic-bxb-avaya-fortinet-revolabs-spectralink.html | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-02 18:12:48
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 181.85.209.113 (181.85.209.113.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 13:12:42.579430 2026] [security2:error] [pid 22143:tid 221 ...
show more
(mod_security) mod_security (id:210350) triggered by 181.85.209.113 (181.85.209.113.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 13:12:42.579430 2026] [security2:error] [pid 22143:tid 22143] [client 181.85.209.113:22944] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||travelto.info|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "travelto.info"] [uri "/booking.html"] [unique_id "aujSmoK4kfiCyDRhI4x6tgAAAAk"], referer: https://travelto.info/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 00:33:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 181.85.209.113 (181.85.209.113.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:32:55.989902 2026] [security2:error] [pid 3999:tid 3999 ...
show more
(mod_security) mod_security (id:210350) triggered by 181.85.209.113 (181.85.209.113.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:32:55.989902 2026] [security2:error] [pid 3999:tid 3999] [client 181.85.209.113:17722] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||anytimesign.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "anytimesign.com"] [uri "/magicblackpolyurethane"] [unique_id "auPlt-lZCz9k-sOJqFoCLgAAAAY"], referer: https://anytimesign.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 05:35:21
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 181.85.209.113 (181.85.209.113.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 01:35:15.201901 2026] [security2:error] [pid 8926:tid 8926 ...
show more
(mod_security) mod_security (id:210350) triggered by 181.85.209.113 (181.85.209.113.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 01:35:15.201901 2026] [security2:error] [pid 8926:tid 8926] [client 181.85.209.113:13163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cyqci.eu|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cyqci.eu"] [uri "/"] [unique_id "at7mk-gxbGsocAd3z8AZCAAAAAQ"], referer: https://petrus-euroqci.eu/national-euroqci
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-20 04:58:19
UTC ·
(2 weeks ago)
Search protection: facets on category: 4 values in one group (limit 3) / reCAPTCHA challenge timed out
Bad Web Bot
🇺🇸
knock
2026-10-13 01:43:30
UTC ·
(3 weeks ago)
Knock-Knock honeypot brute-force: Telnet (1 total hits)
Brute-Force
🇺🇸
cybsecaoccol
2026-10-12 05:49:10
UTC ·
(4 weeks ago)
unauthorized connection or malicious port scan attempted on tcp port 23 - dr
Port Scan
Hacking
🇺🇸
TheAntiBotter
2026-10-11 14:32:58
UTC ·
(4 weeks ago)
propolis: 181.85.209.113 - 53 event(s) across 1 category since 2026-10-11T14:32:49.177035+00:00, current score 5.4
IoT Targeted
🇺🇸
TheAntiBotter
2026-10-11 14:32:58
UTC ·
(4 weeks ago)
propolis: 181.85.209.113 - 53 event(s) across 1 category since 2026-10-11T14:32:49.177035+00:00, current score 86.3
IoT Targeted
🇸🇪
warriors
2026-10-11 02:19:03
UTC ·
(4 weeks ago)
Telnet honeypot observed unclassified post-login shell activity against TCP/23. username=root. Commands: enable, system, shell, sh, linuxshell, ping, busybox.
Hacking
Brute-Force
IoT Targeted
🇺🇸
Cyber Crusader
2026-10-11 00:00:56
UTC ·
(4 weeks ago)
Hundreds of Attempts (at least) to Connect to and Access Firewall Ports
Port Scan
Hacking
Brute-Force
🇵🇹
Information Security
2026-10-10 16:24:58
UTC ·
(4 weeks ago)
Web App Attack
...
Web App Attack
🇺🇸
RAP
2026-10-10 13:30:10
UTC ·
(4 weeks ago)
2026-10-10 13:30:10 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇺🇸
RAP
2026-10-10 06:00:24
UTC ·
(4 weeks ago)
2026-10-10 06:00:24 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
