🇮🇩
sockominfo
2026-06-01 05:00:40
(6 days ago)
User login to application from malicious IP 193.148.16.6., SIMASN Account Signin from Blacklisted IP ...
show more
User login to application from malicious IP 193.148.16.6., SIMASN Account Signin from Blacklisted IP.. Threat Score: 7.8/10 (HIGH). Confidence: 65%. CVSS v3.1: 6.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 98%. MITRE ATT&CK: T1071 (Application Layer Protocol). Tactic: TA0001. Freshness: Moderate. Source Reputation: SUSPICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-06-01 04:00:44
(6 days ago)
User login to application from malicious IP 193.148.16.6., SIMASN Account Signin from Blacklisted IP ...
show more
User login to application from malicious IP 193.148.16.6., SIMASN Account Signin from Blacklisted IP.. Threat Score: 7.8/10 (HIGH). Confidence: 65%. CVSS v3.1: 6.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 98%. MITRE ATT&CK: T1071 (Application Layer Protocol). Tactic: TA0001. Freshness: Fresh. Source Reputation: SUSPICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-06-01 03:00:14
(6 days ago)
SIMASN Account Signin from Blacklisted IP.. Threat Score: 5.8/10 (MEDIUM). Reported by TangerangKota ...
show more
SIMASN Account Signin from Blacklisted IP.. Threat Score: 5.8/10 (MEDIUM). Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-06-01 02:00:18
(6 days ago)
SIMASN Account Signin from Blacklisted IP.. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-C ...
show more
SIMASN Account Signin from Blacklisted IP.. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-06-01 01:00:11
(6 days ago)
SIMASN Account Signin from Blacklisted IP.. Threat Score: 6.1/10 (MEDIUM). Reported by TangerangKota ...
show more
SIMASN Account Signin from Blacklisted IP.. Threat Score: 6.1/10 (MEDIUM). Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇩🇪
grassau.com
2026-05-31 16:58:39
(6 days ago)
(wordpress) Failed wordpress login from 193.148.16.6 (JP/Japan/Tokyo/Tokyo/-)
Brute-Force
🇸🇬
pusathosting.com
2026-05-22 14:05:08
(2 weeks ago)
imap1 failed login
Brute-Force
🇸🇬
securejdprop
2026-04-17 10:42:57
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing. crowdsecurity/http-probing
Hacking
Web App Attack
🇦🇺
MAGIC
2026-04-16 01:04:17
(1 month ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
2026-03-19 03:30:35
(2 months ago)
Malicious activity detected
Hacking
Web App Attack
2026-03-07 05:00:05
(3 months ago)
BruteForce IMAP/POP3/SMTP
Brute-Force
🇺🇸
bigscoots.com
2026-01-08 14:46:45
(4 months ago)
(smtpauth) Failed SMTP AUTH login from 193.148.16.6 (JP/Japan/-): 5 in the last 3600 secs; Ports: 25 ...
show more
(smtpauth) Failed SMTP AUTH login from 193.148.16.6 (JP/Japan/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-01-08 09:46:32 dovecot_login authenticator failed for H=(e7S4YHejD) [193.148.16.6]:1631: 535 Incorrect authentication data ([email protected] )
2026-01-08 09:46:32 dovecot_login authenticator failed for H=(iteBdk1F44) [193.148.16.6]:64563: 535 Incorrect authentication data ([email protected] )
2026-01-08 09:46:32 dovecot_login authenticator failed for H=(Rgy4ccql) [193.148.16.6]:44634: 535 Incorrect authentication data ([email protected] )
2026-01-08 09:46:41 dovecot_login authenticator failed for H=(nEpSHQdu) [193.148.16.6]:21292: 535 Incorrect authentication data ([email protected] )
2026-01-08 09:46:41 dovecot_login authenticator failed for H=(o3QZtUIusJ) [193.148.16.6]:39320: 535 Incorrect authentication data ([email protected] )
show less
Brute-Force
SSH
2025-11-28 15:05:44
(6 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇩🇪
kjaerulff
2025-11-28 12:58:13
(6 months ago)
Failed Wordpress login using xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2025-11-28 08:45:17
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 193.148.16.6 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 193.148.16.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 03:45:14.172637 2025] [security2:error] [pid 3714:tid 3714] [client 193.148.16.6:4402] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||darkalleyproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "darkalleyproductions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSlhGnfg5zARFe42SVtFMQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack