2026-11-07 00:15:03
UTC ·
(14 hours ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/add/product/10945/form_key/ltU540N56v3MzESQ/ | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.2 (KHTML, like Gecko) Chrome/60.0.802.0 Safari/536.2 | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 09:31:08
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 103.135.253.132 (103.135.253-132.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:30:59.833960 2026] [security2:error] [pid 580342:tid 580392] [c ...
show more
(mod_security) mod_security (id:225170) triggered by 103.135.253.132 (103.135.253-132.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:30:59.833960 2026] [security2:error] [pid 580342:tid 580392] [client 103.135.253.132:34863] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||piazzala.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "piazzala.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au2eU6d8hks1BHctR-KbKwAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lostswordfish.com
2026-11-05 13:00:11
UTC ·
(2 days ago)
Wordfence waf block on registrymatters
Web App Attack
🇨🇦
Anytech
2026-11-04 11:00:14
UTC ·
(3 days ago)
Blocked by Conn-Monitor: Contradicting Fingerprint
Bad Web Bot
Web App Attack
Hacking
Spoofing
🇫🇷
ingroscart.it
2026-11-02 16:47:58
UTC ·
(4 days ago)
(wordpress) Failed wordpress login from 103.135.253.132 (BD/Bangladesh/Chittagong/Chittagong/103.135.253-132.antbd.net/[redacted])
Brute-Force
🇪🇸
Mugen
2026-10-31 00:13:37
UTC ·
(1 week ago)
Unauthorized VPN login attempts
Brute-Force
🇨🇿
lp
2026-10-30 11:18:01
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 103.135.253.132
2026-10-30T12:11:49+0100 vpn Access-Reject station: 103.135.253.132
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 18:50:04
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 103.135.253.132 (103.135.253-132.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:49:59.396581 2026] [security2:error] [pid 15369:tid 15369] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 103.135.253.132 (103.135.253-132.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:49:59.396581 2026] [security2:error] [pid 15369:tid 15369] [client 103.135.253.132:45550] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||idmadventures.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "idmadventures.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auOVVwE9Y5viKxLsYrfa3gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
gigatech
2026-10-23 13:20:03
UTC ·
(2 weeks ago)
Webserver Probing
Web App Attack
🇨🇭
backslash
2026-10-22 13:03:04
UTC ·
(2 weeks ago)
block ruleset DA4A07AEE48B136A3922182BE8AA8BFBC1840803
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-21 20:08:16
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 103.135.253.132 (103.135.253-132.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:08:08.190963 2026] [security2:error] [pid 6095:tid 6095] [clien ...
show more
(mod_security) mod_security (id:225170) triggered by 103.135.253.132 (103.135.253-132.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:08:08.190963 2026] [security2:error] [pid 6095:tid 6095] [client 103.135.253.132:58226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||christaylorjazzpianist.arsenaultartistmanagement.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "christaylorjazzpianist.arsenaultartistmanagement.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atkbqDbVEue3UtLJxJqmFAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-20 16:06:57
UTC ·
(2 weeks ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=57&topics%5B3%5D=33&topics%5B4%5D=36&topics%5B5%5D=37 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=57&topics%5B3%5D=33&topics%5B4%5D=36&topics%5B5%5D=37 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇲🇹
Malta
2026-10-19 16:02:48
UTC ·
(2 weeks ago)
103.135.253.132 - - [19/Oct/2026:18:02:48 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
Hacking
Web App Attack
🇫🇷
bigorre.org
2026-10-19 10:12:55
UTC ·
(2 weeks ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇮🇹
sssrit
2026-10-17 02:11:48
UTC ·
(3 weeks ago)
103.135.253.132 - - [17/Oct/2026:04:11:48 +0200] "POST /wp-login.php HTTP/2.0" 401 4725 "https://onida.sssr.it/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
...
Web App Attack
