Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show moreLarge-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /brands/nec/shopby/projector_lumen-2600-11000-7000-4200.html?dir=desc&mode=grid&order=most_viewed | UA: Mozilla/5.0 (iPod; U; CPU iPhone OS 4_1 like Mac OS X; so-ET) AppleWebKit/534.28.4 (KHTML, like Gecko) Version/3.0.5 Mobile/8B117 Safari/6534.28.4 | (Magento Site)
show less
UDP flood (DDoS) vs AS215599: 67 pkts / 0.1 MB to UDP 80/8443 across 55 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. ...
show moreUDP flood (DDoS) vs AS215599: 67 pkts / 0.1 MB to UDP 80/8443 across 55 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
UDP flood (DDoS) vs AS215599: 67 pkts / 0.1 MB to UDP 80/8443 across 55 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. ...
show moreUDP flood (DDoS) vs AS215599: 67 pkts / 0.1 MB to UDP 80/8443 across 55 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
T-Pot honeypot: 220 hits in 15min on port(s) 48432 (P0f/Honeytrap/Suricata). Port scan / unsolicited connection. Automated report.
Port Scan
Anonymous
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp
Distributed application-layer DoS against git.mills.io (self-hosted Gitea). High-volume automated requests to expensive Git repository endpoints (commit/diff/blame/archive views), ~1 request per IP, spoofed browser UA, rejected with HTTP 429. Residen ...
show moreDistributed application-layer DoS against git.mills.io (self-hosted Gitea). High-volume automated requests to expensive Git repository endpoints (commit/diff/blame/archive views), ~1 request per IP, spoofed browser UA, rejected with HTTP 429. Residential-proxy botnet campaign, 2026-06-13/14 UTC.
show less
