🇩🇪
Blexyel
2026-10-30 14:11:56
(12 hours ago)
185.238.231.165 - - [30/Oct/2026:15:11:54 +0100] "GET /wp-login.php HTTP/1.1" 404 577 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36"
...
Brute-Force
Web App Attack
🇺🇸
lostswordfish.com
2026-10-29 16:40:04
(1 day ago)
Wordfence waf block on illinoisvoices
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 07:04:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 03:04:47.646119 2026] [security2:error] [pid 9600:tid 9600] [client 185.238.231.165:63893] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 03:04:47.646119 2026] [security2:error] [pid 9600:tid 9600] [client 185.238.231.165:63893] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haqrry.banis-associates.com"] [uri "/conf/.env"] [unique_id "auGej02CMPL0lrmMj-S3CgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nyt
2026-10-21 23:20:29
(1 week ago)
WP login POST blocked by WAF
Brute-Force
Web App Attack
🇳🇴
jad-abuse
2026-10-18 20:09:45
(1 week ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, git_exposure, db_dump, source_backup. Observed by 1 sensor(s); 14 hits.
Web App Attack
🇸🇬
rocky limit
2026-10-17 07:41:43
(1 week ago)
Fail2ban jail 'nginx-proxy' - 2 failed attempts
Port Scan
Hacking
🇪🇸
librebit
2026-10-17 03:55:02
(1 week ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-10-14 11:33:52
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:33:08.575185 2026] [security2:error] [pid 30930:tid 30930] [client 185.238.231.165:2676 ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:33:08.575185 2026] [security2:error] [pid 30930:tid 30930] [client 185.238.231.165:26767] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.l3l4.com"] [uri "/cgi-bin/.env"] [unique_id "as9odG4r06l-BpMFSP5n2QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 08:23:51
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:23:43.539690 2026] [security2:error] [pid 16925:tid 16925] [client 185.238.231.165:2250 ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:23:43.539690 2026] [security2:error] [pid 16925:tid 16925] [client 185.238.231.165:22501] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oxyveggietv.com.mroxygen.org"] [uri "/.env.production"] [unique_id "as88DwID2q9-RndTJiQdVQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 08:15:34
(2 weeks ago)
[14/Oct/2026:11:15:34 +0300] -- 185.238.231.165 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /.env HTTP/1.1
Bad Web Bot
Web App Attack
🇨🇦
KIsmay
2026-09-30 20:51:07
(1 month ago)
2026-09-30T16:45:33.224459-04:00 www4 WPAudit[905277]: 185.238.231.165 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36" temp3:0812255989qwe FAIL
2026-09-30T16:48:25.42 ...
show more
2026-09-30T16:45:33.224459-04:00 www4 WPAudit[905277]: 185.238.231.165 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36" temp3:0812255989qwe FAIL
2026-09-30T16:48:25.424207-04:00 www4 WPAudit[905277]: 185.238.231.165 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0" wadminw:0192837465z FAIL
2026-09-30T16:49:14.840637-04:00 www4 WPAudit[905277]: 185.238.231.165 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0" wordpressauto:wordpressbl2025 FAIL
2026-09-30T16:50:01.598060-04:00 www4 WPAudit[905277]: 185.238.231.165 bcadjuster.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15" foryourChristmas:Oriper@Mantap1 FAIL
2026-09-30T16:51:06.574027-04:00 www4 WPAudit[905277]: 185.238.231.165 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl
...
show less
Brute-Force
Web App Attack
🇦🇺
afleventoffice.com.au
2026-09-27 23:45:29
(1 month ago)
GET /oauth2/v1/keys HTTP/1.1
Web App Attack
🇦🇺
afleventoffice.com.au
2026-09-27 23:27:28
(1 month ago)
GET /jwks.json HTTP/1.1
Web App Attack
🇫🇷
dynamix
2026-09-09 02:17:30
(1 month ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇮🇩
MirrorMaster
2026-08-24 17:03:43
(2 months ago)
Port Scan
Web App Attack
Bad Web Bot
