🇺🇸
RH5
2026-09-01 21:05:24
(1 day ago)
Restricted URL probing (/.git) (UTC 2026-09-01 21:05)
Web App Attack
🇭🇰
mutebot.net
2026-09-01 19:52:17
(1 day ago)
SRC=128.24.161.84, PROTO=TCP, SPT=63488, DPT=8080
Port Scan
🇩🇪
Stefan Dreher
2026-09-01 18:21:58
(1 day ago)
128.24.161.84 - - [01/Sep/2026:20:21:10 +0200] "GET /.env HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Macint ...
show more
128.24.161.84 - - [01/Sep/2026:20:21:10 +0200] "GET /.env HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
128.24.161.84 - - [01/Sep/2026:20:21:22 +0200] "GET /.env_production HTTP/1.1" 404 125 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
128.24.161.84 - - [01/Sep/2026:20:21:25 +0200] "GET /.env.development HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
128.24.161.84 - - [01/Sep/2026:20:21:28 +0200] "GET /wp-config.php HTTP/1.1" 404 187 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
128.24.161.84 - - [01/Sep/2026:20:21:57 +0200] "GET /proc/self/environ HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Hacking
Brute-Force
🇫🇮
sonot
2026-09-01 17:24:56
(1 day ago)
Blocked by UFW on mail [8081/tcp] | SPT: 63488 | TTL: 111 | LEN: 40 | TOS: 0x00 • Reported by: githu ...
show more
Blocked by UFW on mail [8081/tcp] | SPT: 63488 | TTL: 111 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇫🇷
GabrielJST
2026-09-01 15:45:03
(1 day ago)
*Port Scan* detected from 128.24.161.84 (US/United States/-).
Port Scan
🇩🇪
www.fransveldman.world
2026-08-14 11:09:31
(2 weeks ago)
Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.
Bad Web Bot
🇮🇩
xveil
2026-08-11 06:16:02
(3 weeks ago)
2026-08-11T13:15:59.730367 mail-honeypot postfix/submission/smtpd[2016]: warning: unknown[128.24.161 ...
show more
2026-08-11T13:15:59.730367 mail-honeypot postfix/submission/smtpd[2016]: warning: unknown[128.24.161.84]: SASL PLAIN authentication failed: authentication failure
...
show less
Brute-Force
🇮🇹
VHosting
2026-08-09 09:50:04
(3 weeks ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇳🇱
Roderic
2026-06-17 08:02:26
(2 months ago)
(apache_scanners-2) Failed apache-scanners trigger with match [redacted])
Port Scan
2026-06-15 01:03:07
(2 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇺🇸
xmission.com
2026-06-14 15:43:32
(2 months ago)
Blocked by UFW (TCP on 2078)
Source port: 17849
TTL: 53
Packet length: 60
TOS: 0x00
This report (fo ...
show more
Blocked by UFW (TCP on 2078)
Source port: 17849
TTL: 53
Packet length: 60
TOS: 0x00
This report (for 128.24.161.84) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
crooze.net
2026-06-14 14:51:26
(2 months ago)
128.24.161.84 - - [14/Jun/2026:10:51:25 -0400] "GET /config/database.yml HTTP/1.1" 444 0 "-" "Mozill ...
show more
128.24.161.84 - - [14/Jun/2026:10:51:25 -0400] "GET /config/database.yml HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:59:33
(2 months ago)
(mod_security) mod_security (id:949110) triggered by 128.24.161.84 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:949110) triggered by 128.24.161.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:59:29.007427 2026] [security2:error] [pid 12447:tid 12447] [client 128.24.161.84:18273] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.64.150.239"] [uri "/.git/HEAD"] [unique_id "ai6zwayMUT3LvDtJ1PCGkgAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
crispi
2026-06-14 12:23:30
(2 months ago)
Port scan from 128.24.161.84
Port Scan
🇺🇸
TPI-Abuse
2026-05-27 12:21:21
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 128.24.161.84 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 128.24.161.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 08:21:16.357683 2026] [security2:error] [pid 26991:tid 26991] [client 128.24.161.84:49153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ifmamasang.com"] [uri "/config/.env"] [unique_id "ahbhvGk1q2GLJOi6iTYN-QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
