๐ง๐ท
paradoxnetworks
2026-10-24 00:24:23
(2 days ago)
2026-10-24T00:24:16.980557+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4067819]: pam_unix(sshd: ...
show more
2026-10-24T00:24:16.980557+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4067819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.22.27
2026-10-24T00:24:19.092858+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4067819]: Failed password for invalid user korina from 162.158.22.27 port 57924 ssh2
2026-10-24T00:24:22.117678+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4067819]: Failed password for invalid user korina from 162.158.22.27 port 57924 ssh2
...
show less
Brute-Force
SSH
๐บ๐ธ
TPI-Abuse
2026-10-13 08:36:10
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 04:36:07.925608 2026] [security2:error] [pid 13177:tid 13177] [client 162.158.22.27:12310] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rochesterhistorical.org"] [uri "/.env.dev"] [unique_id "as3tdxqucjjNxxHtty8yKgAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-12 11:51:14
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 07:51:09.359383 2026] [security2:error] [pid 8355:tid 8355] [client 162.158.22.27:11306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adultshop61.net"] [uri "/.env.production"] [unique_id "aszJrbGQP7yHyEqGKDyeggAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-12 01:11:55
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:11:50.482882 2026] [security2:error] [pid 3653:tid 3653] [client 162.158.22.27:9920] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aufflammen.com"] [uri "/.env.dev"] [unique_id "aswz1gytPpDaNKL9NQO6NwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-11 12:18:22
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 08:18:17.159056 2026] [security2:error] [pid 31361:tid 31361] [client 162.158.22.27:13755] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "johnandrews.net"] [uri "/wp-config.php.old"] [unique_id "ast-iVA6DY4pXTChyBrswQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-09 23:10:39
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 19:10:31.349793 2026] [security2:error] [pid 21162:tid 21162] [client 162.158.22.27:11977] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "impactqualityinc.com"] [uri "/.env.local"] [unique_id "asl0Z8MYj7E16nv4bMFgcgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-09 01:48:57
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.22.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:48:52.650032 2026] [security2:error] [pid 24746:tid 24746] [client 162.158.22.27:11847] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myouenji.ichi51e.net"] [uri "/.env.production"] [unique_id "ashIBKd0ywpijmvV25__QwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ง๐ช
madeit
2026-10-07 21:48:00
(2 weeks ago)
Web App Attack
๐ง๐ช
madeit
2026-09-18 14:09:55
(1 month ago)
Web App Attack
๐บ๐ธ
mawan
2025-09-30 22:24:29
(1 year ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
๐บ๐ธ
mawan
2025-07-23 07:19:47
(1 year ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
Anonymous
2025-04-03 07:42:11
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
๐บ๐ธ
WebWizards.NZ
2023-06-13 01:29:54
(3 years ago)
Trolling for resource vulnerabilities
Web App Attack
๐ฟ๐ฆ
IrisFlower
2023-04-24 23:01:46
(3 years ago)
Unauthorized connection attempt detected from IP address 162.158.22.27 to port 80 [J]
Port Scan
Hacking
๐ฟ๐ฆ
IrisFlower
2023-04-17 21:43:47
(3 years ago)
Unauthorized connection attempt detected from IP address 162.158.22.27 to port 80 [J]
Port Scan
Hacking