2026-11-15 10:15:04
UTC ·
(6 hours ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /brands/shopby/manufacturer-lifesize-optoma-rcf-dell-lsi-inspur-xyz.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
justbible
2026-11-09 10:29:02
UTC ·
(6 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 1 request at 2026-11-09T10:29:02+00:00, e.g. 'GET /en/kjv,original,bsb/matt/25/44 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 1 request at 2026-11-09T10:29:02+00:00, e.g. 'GET /en/kjv,original,bsb/matt/25/44 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇩🇪
nyuuzyou
2026-11-05 10:34:26
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-05T10:34:26Z.
Bad Web Bot
🇫🇮
pavel Karpenko
2026-10-21 17:33:02
UTC ·
(3 weeks ago)
92.62.79.193 - - [21/Oct/2026:17:33:02 +0000] "GET /property_lir.php?id=si.stelkom&tab=pa&lang=fr HTTP/1.1" 200 16355 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" client_p ...
show more
92.62.79.193 - - [21/Oct/2026:17:33:02 +0000] "GET /property_lir.php?id=si.stelkom&tab=pa&lang=fr HTTP/1.1" 200 16355 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" client_port=5928 server_port=443 rt=0.329 urt=0.329 transfer_entry=- server_addr=85.137.24.2 epoch=1792603982.368 visitor_cookie=0
show less
DDoS Attack
🇺🇸
鬼影233
2026-09-30 10:28:14
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 06:25:19
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-21 17:09:59
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 02:53:01
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
LRob
2026-08-03 13:45:08
UTC ·
(3 months ago)
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~186,311/tag_ids~275,468,581,493,678/request_format~json/ | UA: Mozilla ...
show more
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~186,311/tag_ids~275,468,581,493,678/request_format~json/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
🇺🇸
kosada.com
2026-08-01 06:17:07
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
EGP Abuse Dept
2026-07-27 02:17:38
UTC ·
(3 months ago)
Scanning for port/service exploits on tpc-012.mach3builders.nl
Port Scan
Hacking
🇺🇸
kosada.com
2026-07-20 04:31:01
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-06-29 06:10:59
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇩
hermawan
2026-04-06 10:57:28
UTC ·
(7 months ago)
[Mon Apr 06 17:57:27.492782 2026] [security2:error] [pid 712679:tid 140018955839168] [client 92.62.79.193:4422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/co ...
show more
[Mon Apr 06 17:57:27.492782 2026] [security2:error] [pid 712679:tid 140018955839168] [client 92.62.79.193:4422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.25.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "618"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET /index.php/profil/meteorologi/geofisika/555558584-poster-skala-gempa-mmi HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/geofisika/555558584-poster-skala-gempa-mmi"] [unique_id "adORlzJXGxF9zajqzgSOswABEwM"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[712698] [NndCiEgPLss] [adORlzJXGxF9zajqzgSOswABEwM] keep_alive=[1] [2026-04-06 17:57:27.492796] [R:adORlzJXGxF9zajqzgSOswABEwM] UA:'Mozilla/5.0 (Linux; Android 10; K)
...
show less
Email Spam
Hacking
2026-02-20 11:00:38
UTC ·
(8 months ago)
scanning http requests from known botnet
Web App Attack
