2026-10-14 10:45:41
(1 hour ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /wishlist/index/add/product/12230/form_key/7aj4US3TSKaZAtx4/ | UA: Mozilla/5.0 (Macintosh; PPC Mac OS X 10_7_9) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/52.0.855.0 Safari/535.2 | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇫🇷
Kejult
2026-10-09 20:32:40
(4 days ago)
Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.
Port Scan
🇺🇸
TPI-Abuse
2026-09-18 02:24:26
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 190.153.66.145 (145.66.153.190.net-uno.net): 1 ...
show more
(mod_security) mod_security (id:210350) triggered by 190.153.66.145 (145.66.153.190.net-uno.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 22:24:20.630211 2026] [security2:error] [pid 13056:tid 13056] [client 190.153.66.145:36811] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||henhousebbq.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "henhousebbq.com"] [uri "/"] [unique_id "aqyg1HArioeruWMviglhYQAAAAE"], referer: https://backlinkanalysis.space/dir/professional-seo-backlinks-91494
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 11:34:35
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 190.153.66.145 (145.66.153.190.net-uno.net): 1 ...
show more
(mod_security) mod_security (id:210350) triggered by 190.153.66.145 (145.66.153.190.net-uno.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 07:34:29.275746 2026] [security2:error] [pid 26414:tid 26414] [client 190.153.66.145:49304] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||phantomkennels.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "phantomkennels.com"] [uri "/"] [unique_id "aqvQRae2MIqV91Uiqr0KUwAAAAI"], referer: https://dacheckerwebsite.store/dir/backlinks-for-search-ranking-161448
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-08-27 05:57:32
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-08-12 02:17:37
(2 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-26 12:40:14
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-03-25 07:19:59
(6 months ago)
2026-03-25 08:19:58 ERROR util.AccessViolations - 190.153.66.145 report to fail2ban - action: block
...
show more
2026-03-25 08:19:58 ERROR util.AccessViolations - 190.153.66.145 report to fail2ban - action: block
...
show less
Hacking
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-19 02:08:09
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 190.153.66.145 (145.66.153.190.net-uno.net): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 190.153.66.145 (145.66.153.190.net-uno.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 18 22:08:01.645442 2026] [security2:error] [pid 11061:tid 11061] [client 190.153.66.145:8470] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||williamfitzsimmons.com|F|2"] [data ".waitingroomlounge.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "williamfitzsimmons.com"] [uri "/news/0410-william-fitzsimmons-spring-tour-update/www.waitingroomlounge.com"] [unique_id "abtagdOlBALaTRf6OGU5FAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-22 02:15:11
(10 months ago)
scanning http requests from known botnet
Web App Attack
🇩🇪
check-the-sum.fr
2025-09-30 19:18:17
(1 year ago)
Port Scanning
Port Scan
🇳🇱
Study Bitcoin 🤗
2025-09-30 16:06:14
(1 year ago)
Port probe to tcp/445 (smb)
[srv127]
Port Scan
Hacking
🇩🇪
IP Analyzer
2025-09-30 16:00:53
(1 year ago)
Unauthorized connection attempt from IP address 190.153.66.145 on Port 445(SMB)
Port Scan
🇳🇱
Study Bitcoin 🤗
2025-09-30 14:54:25
(1 year ago)
Port probe to tcp/445 (smb)
[srv127]
Port Scan
Hacking
