2026-07-25 16:07:05
(12 hours ago)
denied traffic to a non-approved destination port. destination port 19903.
Port Scan
🇩🇪
Vegascosmetics
2026-07-24 10:03:18
(1 day ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected
show less
Hacking
Exploited Host
Web App Attack
2026-07-13 04:49:39
(1 week ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2026-07-11 04:02:35
(2 weeks ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2026-06-01 12:35:07
(1 month ago)
[redacted] 45.250.44.202 - - [01/Jun/2026:14:34:21 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "J ...
show more
[redacted] 45.250.44.202 - - [01/Jun/2026:14:34:21 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)"
[redacted] 45.250.44.202 - - [01/Jun/2026:14:34:31 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
[redacted] 45.250.44.202 - - [01/Jun/2026:14:34:42 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.3; http://site53391039.com"
[redacted] 45.250.44.202 - - [01/Jun/2026:14:34:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.1; http://site76192935.com"
[redacted] 45.250.44.202 - - [01/Jun/2026:14:35:03 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.1; http://site14149619.com"
...
show less
Hacking
Web App Attack
2026-06-01 10:19:10
(1 month ago)
[redacted] 45.250.44.202 - - [01/Jun/2026:12:18:25 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "W ...
show more
[redacted] 45.250.44.202 - - [01/Jun/2026:12:18:25 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 45.250.44.202 - - [01/Jun/2026:12:18:35 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.1; http://site84518593.com"
[redacted] 45.250.44.202 - - [01/Jun/2026:12:18:45 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)"
[redacted] 45.250.44.202 - - [01/Jun/2026:12:18:56 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 45.250.44.202 - - [01/Jun/2026:12:19:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
...
show less
Hacking
Web App Attack
🇫🇮
inlink.ltd
2026-05-25 13:59:02
(2 months ago)
Known malicious PHP file or CMS probe
Web App Attack
🇪🇸
el-brujo
2026-02-28 15:42:35
(4 months ago)
28/Feb/2026:16:42:35.131376 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
28/Feb/2026:16:42:35.131376 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 45.250.44.202] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'sf(f(' [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: sf(f( found within REQUEST_COOKIES:x-ms-gateway-slice: estsfd'/**/PROCEDURE/**/ANALYSE(UPDATEXML(7853,CONCAT('.','~',(SELECT/**/(ELT(7853=7853,1))),'~'),3628),1)-- -"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "tails.elhacker.net"] [uri "/tails/"] [unique_id "aaMM6y0Oa6l7k6KxuSMg6QAAAzU"]
...
show less
Hacking
Web App Attack
🇺🇸
ipblock.com
2026-01-20 21:06:00
(6 months ago)
IPBlock protected site ID [955-wdo][s=02].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
2026-01-19 05:34:41
(6 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Bad Web Bot
Exploited Host
🇨🇦
polycoda
2025-12-03 12:04:46
(7 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
2025-11-25 01:44:02
(8 months ago)
Ports: 25,2525,465,587,2525; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇨🇿
lp
2025-11-21 14:51:17
(8 months ago)
Email account brute force: 2 attempts were recorded from 45.250.44.202
2025-11-21T14:41:58+01:00 war ...
show more
Email account brute force: 2 attempts were recorded from 45.250.44.202
2025-11-21T14:41:58+01:00 warning: unknown[45.250.44.202]: SASL PLAIN authentication failed: authentication failure, [email protected]
2025-11-21T14:41:59+01:00 warning: unknown[45.250.44.202]: SASL LOGIN authentication failed: authentication failure, [email protected]
show less
Brute-Force
🇮🇹
Progetto1
2025-11-21 13:54:02
(8 months ago)
Mail - Multiple failed login attempts
Brute-Force
Exploited Host
2025-11-20 16:17:01
(8 months ago)
failed imap login
Brute-Force