|
Anonymous
|
|
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /brands/shopby/manufacturer-extron-netgear-hp-chief-tv_one-aruba_networks-projectiondesign/product_vc_type-mal_peregovornaja.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 | (Magento Site)
show less
|
Hacking
Bad Web Bot
|
|
🇩🇪
ghostwarriors
|
|
Webpage scraping
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
ksol-hostmaster
|
|
2026/09/28 12:27:58 [error] 69007#1053546: *3395808 access forbidden by rule, client: 91.212.96.37, server: new.hondaforum.hu, request: "GET /topic/honda-turbo/788632/ HTTP/1.1", host: "new.hondaforum.hu"
...
|
Web Spam
|
|
🇺🇸
鬼影233
|
|
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
|
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 91.212.96.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 02:39:29.826041 2026] [security2:error] [pid 27583:tid 27583] [client 91.212.96.37:50682] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 91.212.96.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 02:39:29.826041 2026] [security2:error] [pid 27583:tid 27583] [client 91.212.96.37:50682] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rockwaychiropractic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rockwaychiropractic.com"] [uri "/"] [unique_id "arYXIZ1AROCounegXvKC2wAAAAk"], referer: https://nviromanaa.blogspot.com/
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
鬼影233
|
|
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
|
Bad Web Bot
|
|
🇺🇸
kosada.com
|
|
Web bot: denial-of-service flood
|
DDoS Attack
Bad Web Bot
|
|
🇺🇸
kosada.com
|
|
Web bot: denial-of-service flood
|
DDoS Attack
Bad Web Bot
|
|
🇩🇪
LRob
|
|
CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/cat_ids~644,192,147,647/tag_ids~480,280,339,323,668 ...
show more
CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/cat_ids~644,192,147,647/tag_ids~480,280,339,323,668/request_format~json/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
show less
|
DDoS Attack
Web App Attack
|
|
🇩🇪
LRob
|
|
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763766000/cat_ids~297/tag_ids~588,620,275,252,746/request_format~json/ | UA: Mozilla/5.0 ...
show more
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763766000/cat_ids~297/tag_ids~588,620,275,252,746/request_format~json/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
show less
|
DDoS Attack
Web App Attack
|
|
Anonymous
|
|
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
|
Brute-Force
SSH
|
|
🇵🇹
rnl
|
|
postfix (unknown user, SPF fail or relay access denied)
|
Brute-Force
|
