2026-11-05 08:15:03
UTC ·
(5 days ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /multimedia/display/shopby/display_screentype-plazma/screensize-42-46.html?mode=grid&stock=1 | UA: Opera/8.40.(X11; Linux i686; iu-CA) Presto/2.9.166 Version/10.00 | (Magento Site)
show less
Hacking
Bad Web Bot
🇮🇳
evicky2002
2026-06-29 10:48:52
UTC ·
(4 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇮🇳
evicky2002
2026-06-29 04:52:15
UTC ·
(4 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇵🇱
IROK
2026-06-07 20:58:12
UTC ·
(5 months ago)
2026-06-07T22:58:09.500338 pclab24.pl postfix/smtpd[4147938]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
2026-06-07T22:58:09.501563 pclab24.pl postfix/smtpd[4147935]: warning: unknown[201.37.168.51]: SAS ...
show more
2026-06-07T22:58:09.500338 pclab24.pl postfix/smtpd[4147938]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
2026-06-07T22:58:09.501563 pclab24.pl postfix/smtpd[4147935]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
2026-06-07T22:58:09.512276 pclab24.pl postfix/smtpd[4147937]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
2026-06-07T22:58:09.513082 pclab24.pl postfix/smtpd[4147945]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
2026-06-07T22:58:09.525428 pclab24.pl postfix/smtpd[4147939]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
...
show less
Brute-Force
🇺🇸
bigscoots.com
2026-06-07 20:23:00
UTC ·
(5 months ago)
(smtpauth) Failed SMTP AUTH login from 201.37.168.51 (BR/Brazil/c925a833.virtua.com.br): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-06-07 16:12:11 dovecot_plain authenticator failed for H=(JKJEX) [201.3 ...
show more
(smtpauth) Failed SMTP AUTH login from 201.37.168.51 (BR/Brazil/c925a833.virtua.com.br): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-06-07 16:12:11 dovecot_plain authenticator failed for H=(JKJEX) [201.37.168.51]:64379: 535 Incorrect authentication data ([email protected] )
2026-06-07 16:12:17 dovecot_login authenticator failed for H=(JKJEX) [201.37.168.51]:64379: 535 Incorrect authentication data ([email protected] )
2026-06-07 16:22:53 dovecot_plain authenticator failed for H=(JKJEX) [201.37.168.51]:55765: 535 Incorrect authentication data ([email protected] )
2026-06-07 16:22:57 dovecot_plain authenticator failed for H=(CHXEI8NX18) [201.37.168.51]:55767: 535 Incorrect authentication data ([email protected] )
2026-06-07 16:22:59 dovecot_login authenticator failed for H=(JKJEX) [201.37.168.51]:55765: 535 Incorrect authentication data ([email protected] )
show less
Brute-Force
SSH
🇦🇺
Asimar
2026-06-03 09:03:24
UTC ·
(5 months ago)
(smtpauth) Failed SMTP AUTH login from 201.37.168.51 (BR/Brazil/c925a833.virtua.com.br)
Brute-Force
🇷🇴
gtheo99
2026-06-03 00:02:56
UTC ·
(5 months ago)
(smtpauth) Failed SMTP AUTH login from 201.37.168.51 (BR/Brazil/c925a833.virtua.com.br): 2 in the last 900 secs
Brute-Force
Email Spam
🇨🇿
lp
2026-05-31 12:20:32
UTC ·
(5 months ago)
Email account brute force: 2 attempts were recorded from 201.37.168.51
2026-05-31T13:20:24+02:00 warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-05-31T13:20:25+02:00 warning: ...
show more
Email account brute force: 2 attempts were recorded from 201.37.168.51
2026-05-31T13:20:24+02:00 warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-05-31T13:20:25+02:00 warning: unknown[201.37.168.51]: SASL LOGIN authentication failed: authentication failure, [email protected]
show less
Brute-Force
🇩🇪
phil2k
2026-05-31 10:33:32
UTC ·
(5 months ago)
Fail2ban: Within 2026-05-31 08:09:28 - 2026-05-31 08:14:30 CEST(+0200) banned: 22 times by fail2ban[<MDA>2]; 22 times by fail2ban[<MDA>]; 22 times by fail2ban[recidive]; 22 times by fail2ban[<MTA>]; 22 times by fail2ban[<MTA>-sasl]; 22 times by fail2 ...
show more
Fail2ban: Within 2026-05-31 08:09:28 - 2026-05-31 08:14:30 CEST(+0200) banned: 22 times by fail2ban[<MDA>2]; 22 times by fail2ban[<MDA>]; 22 times by fail2ban[recidive]; 22 times by fail2ban[<MTA>]; 22 times by fail2ban[<MTA>-sasl]; 22 times by fail2ban[<MTA>-ddos]
show less
Brute-Force
Email Spam
DDoS Attack
🇹🇷
baku.hosting
2026-05-31 06:15:44
UTC ·
(5 months ago)
CSF Auto Report: (smtpauth) Failed SMTP AUTH login from 201.37.168.51 (BR/Brazil/c925a833.virtua.com.br): 4 in the last 3600 secs
Brute-Force
Web App Attack
🇩🇪
phil2k
2026-05-31 06:09:30
UTC ·
(5 months ago)
fail2ban:<MDA>:2026-05-31T08:09:28.875857+02:00 <SRV> <MDA>: auth-worker(2074537): conn unix:auth-worker (pid=2074282,uid=108): auth-worker<1>: sql(catalin@<ANONYMIZED_DOMAIN>,201.37.168.51): unknown user
2026-05-31T08:09:28.896897+02:00 <SRV> <MDA>: ...
show more
fail2ban:<MDA>:2026-05-31T08:09:28.875857+02:00 <SRV> <MDA>: auth-worker(2074537): conn unix:auth-worker (pid=2074282,uid=108): auth-worker<1>: sql(catalin@<ANONYMIZED_DOMAIN>,201.37.168.51): unknown user
2026-05-31T08:09:28.896897+02:00 <SRV> <MDA>: auth-worker(2074543): conn unix:auth-worker (pid=2074282,uid=108): auth-worker<1>: sql(catalin@<ANONYMIZED_DOMAIN>,201.37.168.51): unknown user
show less
Port Scan
Brute-Force
Email Spam
🇸🇪
triplecode
2026-05-31 03:16:02
UTC ·
(5 months ago)
Reported from hMailServer
Hacking
🇵🇾
SecOpsSL
2026-05-30 17:10:56
UTC ·
(5 months ago)
May 30 14:10:55 mail postfix/smtps/smtpd[64708]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: authentication failure
Email Spam
Brute-Force
2026-05-30 03:27:04
UTC ·
(5 months ago)
Port scanning: unknown[201.37.168.51]
unknown[201.37.168.51]
unknown[201.37.168.51]
Brute-Force
🇫🇮
notelseit
2026-05-27 01:45:21
UTC ·
(5 months ago)
2026-05-27T03:45:16.413534+02:00 mail postfix/smtps/smtpd[2796958]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-05-27T03:45:20.456796+02:00 mail postfix/smtps/sm ...
show more
2026-05-27T03:45:16.413534+02:00 mail postfix/smtps/smtpd[2796958]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-05-27T03:45:20.456796+02:00 mail postfix/smtps/smtpd[2796959]: warning: unknown[201.37.168.51]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-05-27T03:45:20.710019+02:00 mail postfix/smtps/smtpd[2796959]: disconnect from unknown[201.37.168.51] ehlo=1 auth=0/2 commands=1/3
...
show less
Brute-Force
Email Spam
