🇩🇪
LRob
2026-11-12 00:19:47
UTC ·
(2 days ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/d37f400109558706ebdcf157a1e32e030f42b443/packaging/deb/logrotate | src_port: 54474 | ua: Mozilla/5.0 (Windows NT 1 ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/d37f400109558706ebdcf157a1e32e030f42b443/packaging/deb/logrotate | src_port: 54474 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇳🇱
IPCollective Intelligence
2026-11-10 00:35:40
UTC ·
(4 days ago)
Residential Proxy - IPCollective Intelligence
Open Proxy
🇺🇸
justbible
2026-11-08 18:03:29
UTC ·
(6 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 34 requests from 2026-11-08T18:03:29+00:00 to 2026-11-11T12:01:48+00:00, e.g. 'GET /en/kjv,lsv/matt/8/29 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 34 requests from 2026-11-08T18:03:29+00:00 to 2026-11-11T12:01:48+00:00, e.g. 'GET /en/kjv,lsv/matt/8/29 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-27 22:47:42
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 186.158.200.140 (host140.186-158-200.claro.com.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 18:47:37.247791 2026] [security2:error] [pid 32379:tid 3237 ...
show more
(mod_security) mod_security (id:210350) triggered by 186.158.200.140 (host140.186-158-200.claro.com.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 18:47:37.247791 2026] [security2:error] [pid 32379:tid 32379] [client 186.158.200.140:9466] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||limobusstlouis.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "limobusstlouis.com"] [uri "/"] [unique_id "auEqCdf7YPHxdeV5wQFr2AAAABA"], referer: https://analyticshaven.top/stats/50582
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇳
my meibu
2026-10-11 23:39:02
UTC ·
(1 month ago)
[T-0120] Track H-2 banned coordinated sitescan: 186.158.200.140 cluster=8 pages=8 dispersion=1.00
Web App Attack
🇺🇸
kosada.com
2026-10-11 05:07:44
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A339&f%5B1%5D=digest_key_terms%3A360&f%5B2%5D=digest_key_terms%3A386&f%5B3%5D=digest_key_terms%3A521 (HTTP/1.1 port 443, user ag ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A339&f%5B1%5D=digest_key_terms%3A360&f%5B2%5D=digest_key_terms%3A386&f%5B3%5D=digest_key_terms%3A521 (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇨🇭
backslash
2026-10-03 14:57:04
UTC ·
(1 month ago)
block ruleset A5EE6C8F745F0934168261886A3817E5C386412A
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 14:05:00
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 05:27:43
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇪🇸
librebit
2026-09-29 15:45:53
UTC ·
(1 month ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-09-28 20:01:11
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 186.158.200.140 (host140.186-158-200.claro.com.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 16:01:03.719258 2026] [security2:error] [pid 4133:tid 4133] ...
show more
(mod_security) mod_security (id:210350) triggered by 186.158.200.140 (host140.186-158-200.claro.com.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 16:01:03.719258 2026] [security2:error] [pid 4133:tid 4133] [client 186.158.200.140:54455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||connectigramme.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "connectigramme.com"] [uri "/"] [unique_id "arrHfwAOmaaABFjNOCEGOAAAAA0"], referer: https://allezmatelot.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-25 03:18:22
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 19:07:44
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 05:56:25
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇮🇩
hermawan
2026-09-22 08:43:07
UTC ·
(1 month ago)
Captured JA4H: ge11n_133fd66ef233 | Log: 186.158.200.140 - - [22/Sep/2026:15:42:38 +0700] "GET /index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografis-dasarian-analisis-kejadian-hujan-lebat HTTP/1.1" 200 14171 "https://staklim-jati ...
show more
Captured JA4H: ge11n_133fd66ef233 | Log: 186.158.200.140 - - [22/Sep/2026:15:42:38 +0700] "GET /index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografis-dasarian-analisis-kejadian-hujan-lebat HTTP/1.1" 200 14171 "https://staklim-jatim.bmkg.go.id/" "Mozilla/5.0 (Linux; U; Android 13; SM-G980F Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/139.0.7258.160 Mobile Safari/537.36 OPR/94.0.2254.78762" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,upgrade-insecure-requests,cf-ew-via,cdn-loop,sec-fetch-user,sec-fetch-site,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,sec-fetch-mode,cf-visitor,sec-fetch-dest,priority,save-data,sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,cf-ipcountry...
...
show less
Email Spam
Hacking
