🇺🇸
MPL
2026-04-16 20:34:01
(1 month ago)
tcp/8087 (2 or more attempts)
Port Scan
🇺🇸
MPL
2026-03-08 20:17:14
(3 months ago)
tcp/8080
Port Scan
2026-03-08 19:59:55
(3 months ago)
2026-03-08T20:59:54.499086+01:00 vps kernel: [34740239.602832] [PORTSCAN DETECTED] IN=ens3 OUT= MAC= ...
show more
2026-03-08T20:59:54.499086+01:00 vps kernel: [34740239.602832] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=161.35.118.238 DST=54.37.14.118 LEN=44 TOS=0x00 PREC=0x00 TTL=234 ID=34347 PROTO=TCP SPT=61004 DPT=8084 WINDOW=1025 RES=0x00 SYN URGP=0
...
show less
Port Scan
Brute-Force
🇫🇷
adembaysal
2026-01-04 03:22:04
(5 months ago)
Rule : FTP
2026-01-04 03:16:35 161.35.118.238 - ***hidden-privacy*** 21 PASS *** 530 1326 41 25 15 0 ...
show more
Rule : FTP
2026-01-04 03:16:35 161.35.118.238 - ***hidden-privacy*** 21 PASS *** 530 1326 41 25 15 0 0aef1f3c-fbbd-4d82-ac10-2884b776ee0c -
show less
FTP Brute-Force
🇧🇷
KingHost
2026-01-02 18:41:15
(5 months ago)
Brute-Force
🇧🇪
voormedia
2026-01-02 15:22:17
(5 months ago)
Accessed trap at '/.env'
Web App Attack
🇺🇸
TPI-Abuse
2026-01-02 15:15:07
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 161.35.118.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 161.35.118.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 02 10:15:01.449249 2026] [security2:error] [pid 25701:tid 25701] [client 161.35.118.238:62326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amoriotech.com"] [uri "/.env"] [unique_id "aVfg9e0VD-W1byu2Ep1m4gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-02 09:39:22
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 161.35.118.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 161.35.118.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 02 04:39:17.503685 2026] [security2:error] [pid 3587546:tid 3587546] [client 161.35.118.238:57382] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lloydprins.com"] [uri "/.env"] [unique_id "aVeSRTbT8EQJTFwtqna9BwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-01-02 09:37:38
(5 months ago)
. Matched phrase "/.env" at REQUEST_URI. (210492-123)
Web App Attack
🇺🇸
TPI-Abuse
2026-01-02 04:21:54
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 161.35.118.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 161.35.118.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 01 23:21:49.161662 2026] [security2:error] [pid 9301:tid 9301] [client 161.35.118.238:64279] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "machinetoolsjwk.com"] [uri "/.env"] [unique_id "aVdH3XC4rDspGTf9M_LWngAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-01-01 15:01:19
(5 months ago)
23.654 requests in 1 hour (2mos2d15h)
Brute-Force
Bad Web Bot
🇧🇷
vfAcceloReporter
2026-01-01 14:15:27
(5 months ago)
161.35.118.238 - - [01/Jan/2026:11:15:24 -0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 555 "-" "Mozilla/ ...
show more
161.35.118.238 - - [01/Jan/2026:11:15:24 -0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
161.35.118.238 - - [01/Jan/2026:11:15:25 -0300] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
161.35.118.238 - - [01/Jan/2026:11:15:25 -0300] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
161.35.118.238 - - [01/Jan/2026:11:15:26 -0300] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
161.35.118.238 - - [01/Jan/2026:11:15:26 -0300] "GET /website/wp-includes/wlwmanifest.xml HTTP/1.1" 404 55
...
show less
Brute-Force
Exploited Host
Web App Attack
🇫🇷
solution.it
2026-01-01 05:23:59
(5 months ago)
[Thu Jan 01 06:23:58.364228 2026] [php7:error] [pid 472965:tid 472965] [client 161.35.118.238:57942] ...
show more
[Thu Jan 01 06:23:58.364228 2026] [php7:error] [pid 472965:tid 472965] [client 161.35.118.238:57942] script '/var/www/html/wp-login.php' not found or unable to stat, referer: http://solution.it/wp-admin/
show less
Web App Attack
🇺🇸
agenciahypelab.com.br
2025-12-31 17:23:20
(5 months ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇨🇭
backslash
2025-12-29 11:45:06
(5 months ago)
block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1
Bad Web Bot