๐ท๐บ
31.131.135.250
07 Jul 2023
CONNECT www.msftncsi.com:443 HTTP/1.1
Web Spam
Bad Web Bot
Web App Attack
๐บ๐ธ
104.149.144.45
05 Jul 2023
Unathorised VPN Login Attempts
Port Scan
Hacking
Brute-Force
Exploited Host
๐ง๐ฟ
138.99.216.146
04 Jul 2023
Unauthorized SSL VPN Login Attempt with username 'netadmin'
VPN IP
Brute-Force
๐ฎ๐ฉ
103.31.224.54
03 Jul 2023
Spam, Phishing
<17>1 2023-07-03T06:56:09+0300 mail3 emsx 1980 - - CEF:0|ESET|emsx|10.0.10016.0|400 ...
show more
Spam, Phishing
<17>1 2023-07-03T06:56:09+0300 mail3 emsx 1980 - - CEF:0|ESET|emsx|10.0.10016.0|400|MailScanResult: policy|9|rt=1688356569000 src=103.31.224.54 shost=mail.***.*** dhost=mail3 flexString1=<20230702203656.58FFCEAC8A0E4847@***.***> [email protected] duser=*****@*****.*****act=Cleaned and quarantined cat=policy sourceServiceName=SMTP transport agent deviceExternalId=27506 (20230702), 7955 (20230606) cs1Label=Anti-Malware result cs1=HTML/Phishing.Agent.AUW trojan cs2Label=Anti-Spam result cs2= cs3Label=Anti-Phishing result cs3= cs4Label=SPF/DKIM/DMARC result cs4=Authentication-Results: mail3.***.****; none cs5Label=From header cs5=admin@****.****cs6Label=To and Cc headers cs6=*****@****.**** fname=part001.htm fileHash=C0BE2E25B6C7C85FF852DD153A85382CA3EE9E38F74DF478DDB2B753500DCB2B fsize=9099 reason=Malware message msg=Final Password Expiry Notice for *****@*****.**** ESETEMSXFileDetails=|358D610D36531DE6DFFE04015D5C21425B6996B6DEEFAF1C3553DF3E590FD127|0|part000.txt|F4C
show less
Phishing
Email Spam
๐บ๐ธ
107.152.46.59
19 Jun 2023
Fortigate VPN brute-force with username 'admin'
Brute-Force
๐ฒ๐พ
1.9.70.21
12 Jun 2023
Mail spoofing with OWA phishing link
Phishing
Web Spam
Spoofing
๐ง๐ฌ
79.124.59.158
09 Jun 2023
VPN Brute Force: date=2023-06-08 time=21:16:50 devname="*******" devid="FG*********" eventtime=16862 ...
show more
VPN Brute Force: date=2023-06-08 time=21:16:50 devname="*******" devid="FG*********" eventtime=1686248211124980474 tz="+0300" logid="0101039426" type="event" subtype="vpn" level="alert" vd="VPN_Client" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=79.124.59.158 user="synology" group="N/A" dst_host="N/A" reason="vpn_login_unknown_user" msg="user failed to logged in"
show less
Hacking
Brute-Force
๐ต๐ฐ
203.215.173.205
08 Jun 2023
Phishing mail targeting Microsoft Exchange Server
Phishing
Email Spam
Spoofing
๐ธ๐จ
88.214.26.37
08 Jun 2023
Unauthorized VPN login attempt with username 'sigma'
Brute-Force
Web App Attack
๐บ๐ธ
91.222.174.98
05 Jun 2023
Mail from [email protected] with title "Payment Reciept of $30,671.23" send's phishing attachment " ...
show more
Mail from [email protected] with title "Payment Reciept of $30,671.23" send's phishing attachment "PDF/Phishing.A.Gen trojan"
Time: 05.06.2023 13:43
show less
Phishing
๐จ๐ฆ
138.197.154.201
01 Jun 2023
138.197.154.201 - - [01/Jun/2023:17:46:10 +0300] "GET /geoip/ HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Wi ...
show more
138.197.154.201 - - [01/Jun/2023:17:46:10 +0300] "GET /geoip/ HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
show less
Bad Web Bot
๐ฉ๐ช
85.10.222.209
01 Jun 2023
DDoS attacker
DDoS Attack
๐ท๐บ
185.161.248.122
01 Jun 2023
Port scaning: date=2023-06-01 time=09:55:21 devname="****" devid="*****" eventtime=16856025217453998 ...
show more
Port scaning: date=2023-06-01 time=09:55:21 devname="****" devid="*****" eventtime=1685602521745399826 tz="+0300" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" vd="***" severity="critical" srcip=185.161.248.122 dstip=**.***.***.* srcintf="Internet" srcintfrole="undefined" sessionid=0 action="detected" proto=6 service="FTPS" count=5 attack="ip_dst_session" srcport=41376 dstport=6341 attackid=16777324 policyid=1 policytype="DoS-policy" msg="anomaly: ip_dst_session, 4435 > threshold 2500, repeats 5 times since last log"
show less
Port Scan
๐บ๐ธ
154.53.42.211
01 Jun 2023
URLs Probing: 154.53.42.211 - - [31/May/2023:14:10:46 +0300] "POST /debug/default/view?panel=config ...
show more
URLs Probing: 154.53.42.211 - - [31/May/2023:14:10:46 +0300] "POST /debug/default/view?panel=config HTTP/1.1" 400 37 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
172.190.92.68
30 May 2023
SSL VPN brute-force with users: netlogic admin test remote it backup bkadmin user1 sslvpn_user suppo ...
show more
SSL VPN brute-force with users: netlogic admin test remote it backup bkadmin user1 sslvpn_user support guest vpn_user
show less
Brute-Force
๐บ๐ธ
209.126.11.159
30 May 2023
209.126.11.159 - - [30/May/2023:08:37:49 +0300] "POST /debug/default/view?panel=config HTTP/1.1" 405 ...
show more
209.126.11.159 - - [30/May/2023:08:37:49 +0300] "POST /debug/default/view?panel=config HTTP/1.1" 405 580 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
show less
Hacking
Bad Web Bot
๐ฌ๐ง
79.124.62.197
26 May 2023
Attack on VPN - user 'admin'
Brute-Force
๐บ๐ธ
104.152.52.3
22 May 2023
TCP Port Scan
Port Scan
๐บ๐ธ
47.254.123.52
22 May 2023
TCP Port scan
Port Scan
๐บ๐ธ
47.254.120.40
15 May 2023
[05:40:46] Fortigate tcp_port_scan
Port Scan
๐จ๐พ
5.8.18.236
14 May 2023
VPN Brute Force: date=2023-05-14 time=12:10:37 devname="*****" devid="******" eventtime=168405543782 ...
show more
VPN Brute Force: date=2023-05-14 time=12:10:37 devname="*****" devid="******" eventtime=1684055437829806592 tz="+0300" logid="0101039426" type="event" subtype="vpn" level="alert" vd="VPN_Client" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=5.8.18.236 user="manadger" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
Hacking
Brute-Force
๐ฒ๐ฝ
201.163.190.64
14 May 2023
Web Attacks: LIKE 201.163.190.64 - - [14/May/2023:01:45:39 +0300] "GET /phpMyAdmin-5.2.0/index.php?l ...
show more
Web Attacks: LIKE 201.163.190.64 - - [14/May/2023:01:45:39 +0300] "GET /phpMyAdmin-5.2.0/index.php?lang=en HTTP/1.1" 404 77 "http://**.**.***.**/phpMyAdmin-5.2.0/index.php?lang=en" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"
show less
Hacking
Bad Web Bot
Web App Attack
๐ณ๐ฑ
185.224.128.130
11 May 2023
VPN Brute Force: date=2023-05-11 time=14:34:33 devname="*******" devid="******" eventtime=1683804873 ...
show more
VPN Brute Force: date=2023-05-11 time=14:34:33 devname="*******" devid="******" eventtime=1683804873437328065 tz="+0300" logid="0101039426" type="event" subtype="vpn" level="alert" vd="VPN_Client" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=185.224.128.130 user="jalal" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
Hacking
Brute-Force
๐จ๐ณ
61.174.173.213
11 May 2023
[03:42:05] EK-Mozi exploit attempt
Hacking
๐ณ๐ฑ
185.224.128.130
11 May 2023
Brute Force VPN: date=2023-05-11 time=09:52:31 devname="********" devid="*********" eventtime=168378 ...
show more
Brute Force VPN: date=2023-05-11 time=09:52:31 devname="********" devid="*********" eventtime=1683787951670980487 tz="+0300" logid="0101039426" type="event" subtype="vpn" level="alert" vd="VPN_Client" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=185.224.128.130 user="360Consulenza" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
Hacking
Brute-Force