🇫🇷
JohnAtlas
2026-11-15 04:12:15
UTC ·
(1 hour ago)
Honeypot: connection attempt to unused port(s) 23/tcp on a server where these services do not exist. Automated firewall trap.
Port Scan
Hacking
IoT Targeted
🇩🇪
Jochen Pretli
2026-11-15 02:45:26
UTC ·
(3 hours ago)
connection to honeypot
Email Spam
Port Scan
🇧🇷
cibersecoptidata
2026-11-14 02:53:08
UTC ·
(1 day ago)
Port scan / Unsolicited traffic.
Port Scan
2026-11-14 02:08:45
UTC ·
(1 day ago)
denied traffic to a honeypot network. destination port 23.
Port Scan
Hacking
🇩🇪
Kitki30.com
2026-11-12 02:01:11
UTC ·
(3 days ago)
Entered Telnet Tarpit (endlessh, server 3).
Log: 2026-11-12T02:01:11.422Z ACCEPT host=::ffff:200.52.29.168 port=20132 fd=410 n=652/1020
IoT Targeted
Port Scan
Brute-Force
🇵🇹
PT
2026-11-09 10:14:46
UTC ·
(5 days ago)
web app attack (botnet)
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 19:21:23
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 200.52.29.168 (168.29.52.200.in-addr.arpa.verointernet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 15:21:19.613568 2026] [security2:error] [pid 23 ...
show more
(mod_security) mod_security (id:210350) triggered by 200.52.29.168 (168.29.52.200.in-addr.arpa.verointernet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 15:21:19.613568 2026] [security2:error] [pid 23283:tid 23283] [client 200.52.29.168:8843] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||roachranch.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "roachranch.com"] [uri "/"] [unique_id "aqrsL7EU9Q57gH6rwbAD8wAAAAU"], referer: https://bestrankbacklinks.com/dicelrseo
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-24 19:01:30
UTC ·
(11 months ago)
scanning http requests from known botnet
Web App Attack
2025-11-20 23:28:35
UTC ·
(11 months ago)
scanning http requests from known botnet
Web App Attack
🇧🇷
LM Security
2023-11-15 14:45:02
UTC ·
(2 years ago)
2023-11-15 11:43:23 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:11588: 535 Incorrect authentication data (set_id=cristina.hammes@[redacted].com.br)
2023-11-15 11:43:14 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]: ...
show more
2023-11-15 11:43:23 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:11588: 535 Incorrect authentication data (set_id=cristina.hammes@[redacted].com.br)
2023-11-15 11:43:14 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:23504: 535 Incorrect authentication data (set_id=cristina.massiroli@[redacted].com.br)
show less
Brute-Force
🇧🇷
SvrAdmin
2023-11-15 14:32:48
UTC ·
(2 years ago)
[101] (smtpauth) Failed SMTP AUTH login from 200.52.29.168 (BR/Brazil/200-52-29-168.dynamic.ultrawave.com.br): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2023-11-15 11:25:04 dovecot_login authenticator failed for ...
show more
[101] (smtpauth) Failed SMTP AUTH login from 200.52.29.168 (BR/Brazil/200-52-29-168.dynamic.ultrawave.com.br): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2023-11-15 11:25:04 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:23529: 535 Incorrect authentication data ([email protected] )
2023-11-15 11:25:31 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:24621: 535 Incorrect authentication data ([email protected] )
2023-11-15 11:30:22 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:51340: 535 Incorrect authentication data ([email protected] )
2023-11-15 11:30:34 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:12615: 535 Incorrect authentication data ([email protected] )
2023-11-15 11:32:46 dovecot_login authenticator failed for (ADMIN) [200.52.29.168]:12414: 535 Incorrect authentication data ([email protected] )
show less
Port Scan
Hacking
Brute-Force
Exploited Host
