Total reports
8 from
7 distinct
reporters
First reported
November 18th 2025
Most recent report
1 day ago
Last 60 days
Top reporter locations
🇩🇪
Germany
1
🇷🇺
Russian Federation
1
🇺🇸
United States of America
1
Most common categories
Bad Web Bot
3
DDoS Attack
1
Hacking
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
2026-11-09 14:15:04
UTC ·
(1 day ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /brands/shopby/manufacturer-extron-hp-beyerdynamic-sony-xclaim-sanus.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇩🇪
LRob
2026-11-08 02:03:52
UTC ·
(2 days ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/d82fd8c36831a7723d0e6b9c70111247466925d0/internal/store/addressish_test.go | src_port: 1038 | ua: Mozilla/5.0 (M ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/d82fd8c36831a7723d0e6b9c70111247466925d0/internal/store/addressish_test.go | src_port: 1038 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 16:25:58
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
2026-09-10 13:57:49
UTC ·
(2 months ago)
denied Telnet access attempt. destination port 23.
Port Scan
Brute-Force
🇸🇬
mypatricks
2026-04-24 07:55:45
UTC ·
(6 months ago)
196.189.121.124 | Port: 13677 | DNS: 196.189.121.124 2026-04-24T15:55:44+08:00 Africa/Addis_Ababa | IPs res erved list | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 HTTP/1.1 443 ...
show more
196.189.121.124 | Port: 13677 | DNS: 196.189.121.124 2026-04-24T15:55:44+08:00 Africa/Addis_Ababa | IPs res erved list | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 HTTP/1.1 443 GET | URL: /?badfccdfdefcf=1059 | Ref: https://xxxxxx/?adfcebbdfdfed=1061 | Country: ET/Ethiopia/+02:00 IP City: Addis Ababa Windows 9f138c1d5b06e6b4-ADD/ADD 1 hits/0 secs Browser 1
show less
Brute-Force
Web App Attack
Blog Spam
Web Spam
Exploited Host
2026-01-13 12:51:17
UTC ·
(9 months ago)
Unauthorized connection attempt on Port 23
Port Scan
Hacking
Exploited Host
2025-11-19 17:36:36
UTC ·
(11 months ago)
scanning http requests from known botnet
Web App Attack
🇮🇩
hermawan
2025-11-18 07:30:40
UTC ·
(11 months ago)
[Tue Nov 18 14:29:59.624656 2025] [security2:error] [pid 274913:tid 140213005309632] [client 196.189.121.124:29535] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "WOW64" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/core ...
show more
[Tue Nov 18 14:29:59.624656 2025] [security2:error] [pid 274913:tid 140213005309632] [client 196.189.121.124:29535] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "WOW64" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "247"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: WOW64 found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 request_line = GET /index.php/profil/meteorologi/list-all-categories/4221-klimatologi/prakiraan-klimatologi/prakiraan-dasarian/prakiraan-dasarian-daerah-potensi-banjir/prakiraan-dasarian-daerah-potensi-banjir-di-provinsi-jawa-timur/prakiraan-dasarian-daerah-potensi-banjir-di-provinsi-jawa-timur-tahun-2024/555561515-prakiraan-dasarian-da..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-al
...
show less
Hacking
Web App Attack
