🇫🇷
cyber.pandata.ninja
2026-11-11 15:10:27
UTC ·
(3 days ago)
Suricata IDS detection: ET EXPLOIT HackingTrio UA (Hello, World) [Attempted Administrator Privilege Gain]. Seen 2026-11-11 UTC.
Hacking
Web App Attack
2026-11-06 01:15:04
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/add/product/1136/form_key/Y6busIw6i0DRWwTU/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-02 08:49:56
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-29 07:52:58
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
reznekcs
2026-09-22 05:03:01
UTC ·
(1 month ago)
Blocked by UFW firewall
Brute-Force
🇺🇸
RAP
2026-09-11 07:56:20
UTC ·
(2 months ago)
2026-09-11 07:56:20 UTC Unauthorized activity to TCP port 8080. Web App
Port Scan
Web App Attack
🇫🇷
Petre 21_ip
2026-09-10 14:57:55
UTC ·
(2 months ago)
2026-09-10T16:57:54.623315+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=39.34.166.199 DST=155.133.26.57 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=14551 DF PROTO=TCP SPT=61999 DPT=8080 WINDOW=14400 RES= ...
show more
2026-09-10T16:57:54.623315+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=39.34.166.199 DST=155.133.26.57 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=14551 DF PROTO=TCP SPT=61999 DPT=8080 WINDOW=14400 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇺🇸
MPL
2026-08-13 00:36:27
UTC ·
(3 months ago)
tcp/23
Port Scan
2026-08-12 16:01:29
UTC ·
(3 months ago)
23/tcp (1 or more attempts)
Port Scan
🇬🇧
OptimusGO
2026-08-12 10:16:01
UTC ·
(3 months ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-08-12 11:16:00 UTC
Log evidence:
08/12/2026-11:16:00.285048 [wDrop] [**] [1:7001101:1] FINSERV CRITICAL: Telnet Access Blocked [**] [Cl ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-08-12 11:16:00 UTC
Log evidence:
08/12/2026-11:16:00.285048 [wDrop] [**] [1:7001101:1] FINSERV CRITICAL: Telnet Access Blocked [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 39.34.166.199:34918 -> 185.127.18.66:23
08/12/2026-11:16:00.285048 [**] [1:1000103:1] SECURITY Management Port Probe - CRITICAL [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 39.34.166.199:34918 -> 185.127.18.66:23
show less
Port Scan
Brute-Force
🇫🇷
Hiigara
2026-08-11 22:01:10
UTC ·
(3 months ago)
connection attempt : 39.34.166.199 on port : tcp/8080 (HTTP-alt)
Port Scan
🇺🇸
TPI-Abuse
2026-06-21 17:56:32
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 39.34.166.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 13:56:28.416682 2026] [security2:error] [pid 22471:tid 22471] [client 39.34.166.199:33690] M ...
show more
(mod_security) mod_security (id:240335) triggered by 39.34.166.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 13:56:28.416682 2026] [security2:error] [pid 22471:tid 22471] [client 39.34.166.199:33690] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.34.166.199 (+1 hits since last alert)|lumentravel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lumentravel.com"] [uri "/xmlrpc.php"] [unique_id "ajglzEPfohfkGC5hOocAsgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
