🇺🇸
LotPhantom
2026-05-04 02:31:13
(1 month ago)
2026/05/04 02:31:12 [error] 2028423#2028423: *47108 connect() failed (111: Connection refused) while ...
show more
2026/05/04 02:31:12 [error] 2028423#2028423: *47108 connect() failed (111: Connection refused) while connecting to upstream, client: 104.207.36.165, server: wynnesmiles.com, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:4001/", host: "wynnesmiles.com"
...
show less
Web App Attack
🇱🇻
garmtech.com
2026-05-03 20:23:19
(1 month ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 23-23.104.207.36.165.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 23-23.104.207.36.165.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇩🇪
LRob.fr
2026-05-02 17:15:07
(1 month ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇬🇧
Steve
2026-03-25 13:04:41
(2 months ago)
Repeated attempts against wordpress site
Brute-Force
Web App Attack
🇦🇺
nzhost.co.nz
2026-02-19 12:32:24
(4 months ago)
$f2bV_matches
Hacking
Brute-Force
🇺🇸
mnsf
2026-02-15 23:06:06
(4 months ago)
Scanning/Probing (25)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 12:45:48
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:45:41.757152 2026] [security2:error] [pid 10764:tid 10764] [client 104.207.36.165:20573] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "toberoocrafts.com"] [uri "/v2/.git/config"] [unique_id "aZG_9akrzBY-kgT-2OaFjwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 12:27:03
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:26:48.883865 2026] [security2:error] [pid 16827:tid 16827] [client 104.207.36.165:46563] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "title44.com"] [uri "/.env"] [unique_id "aZG7iAgsTz_-lV9LjdmhKQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
nzhost.co.nz
2026-02-15 12:25:47
(4 months ago)
$f2bV_matches
Hacking
Brute-Force
🇮🇩
Burayot
2026-02-15 12:09:17
(4 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.36.165 (US/United States/-) ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.36.165 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 11:55:38
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:55:35.647523 2026] [security2:error] [pid 21728:tid 21728] [client 104.207.36.165:26215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teamsewusa.com"] [uri "/wp/.git/config"] [unique_id "aZG0Nx_pLrutRlCZjWE2GAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 11:34:50
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:34:47.287112 2026] [security2:error] [pid 5646:tid 5646] [client 104.207.36.165:11435] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thinkerblox.com"] [uri "/admin/.env"] [unique_id "aZGvV9viNh1-fJ5ZHRPHdgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Sylvyon
2026-02-15 06:06:06
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.aws/credentials | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
myagent.site
2026-02-15 05:34:50
(4 months ago)
Blocking for trying to access an exploit file: /v2/.git/config
Hacking
🇺🇸
TPI-Abuse
2026-02-15 03:20:49
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.36.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 22:20:43.965074 2026] [security2:error] [pid 6541:tid 6541] [client 104.207.36.165:47891] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "starrmail.net"] [uri "/test/.git/config"] [unique_id "aZE7i68lGB_sNLfCVaTI0QAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack