🇨🇿
Prcek
2026-11-12 03:24:06
UTC ·
(17 hours ago)
PortScan:HOST=162.158.23.80,DPORTS=443
Port Scan
🇺🇸
TPI-Abuse
2026-11-02 14:53:14
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:53:06.367108 2026] [security2:error] [pid 4115:tid 4115] [client 162.158.23.80:13800] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:53:06.367108 2026] [security2:error] [pid 4115:tid 4115] [client 162.158.23.80:13800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gegraphics.biz"] [uri "/.env.staging"] [unique_id "auij0sUflU3KnNSfCjh80gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
paradoxnetworks
2026-10-22 11:47:47
UTC ·
(3 weeks ago)
2026-10-22T11:47:41.138050+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[3762870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.23.80
2026-10-22T11:47:43.245925+00:00 edge-con-sao01.int.pdx.net.uk ...
show more
2026-10-22T11:47:41.138050+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[3762870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.23.80
2026-10-22T11:47:43.245925+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[3762870]: Failed password for invalid user admin from 162.158.23.80 port 59068 ssh2
2026-10-22T11:47:46.690005+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[3762870]: Failed password for invalid user admin from 162.158.23.80 port 59068 ssh2
...
show less
Brute-Force
SSH
🇫🇷
dynamix
2026-10-19 15:25:34
UTC ·
(3 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 17:28:32
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 13:28:24.707933 2026] [security2:error] [pid 22446:tid 22446] [client 162.158.23.80:9520] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 13:28:24.707933 2026] [security2:error] [pid 22446:tid 22446] [client 162.158.23.80:9520] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adampayments.com"] [uri "/.env.local"] [unique_id "atENOCn1sfy0h6RgHMOXRwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-14 17:19:56
UTC ·
(4 weeks ago)
[WedOct1419:19:53.5758642026][security2:error][pid2797198:tid2797222][client162.158.23.80:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacc ...
show more
[WedOct1419:19:53.5758642026][security2:error][pid2797198:tid2797222][client162.158.23.80:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"laumeiconsulting.com\"][uri\"/wp-config.php.bak\"][unique_id\"as-5ucA2cqfu5z77l_TUTAAAAAo\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 08:28:57
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:28:48.220879 2026] [security2:error] [pid 16560:tid 16579] [client 162.158.23.80:11626] M ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:28:48.220879 2026] [security2:error] [pid 16560:tid 16579] [client 162.158.23.80:11626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "browbrew.com"] [uri "/.env.save"] [unique_id "as89QP8C61m6-V_eSyDl1QAAANE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-10-13 07:07:38
UTC ·
(4 weeks ago)
[TueOct1309:07:33.6820512026][security2:error][pid3841374:tid3841449][client162.158.23.80:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-B ...
show more
[TueOct1309:07:33.6820512026][security2:error][pid3841374:tid3841449][client162.158.23.80:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"hostingedominio.net\"][uri\"/.aws/credentials\"][unique_id\"as3YtSkDrRu78mTIOE4lHAAAAIs\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 02:10:36
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 22:10:29.253972 2026] [security2:error] [pid 13728:tid 13789] [client 162.158.23.80:10088] M ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 22:10:29.253972 2026] [security2:error] [pid 13728:tid 13789] [client 162.158.23.80:10088] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robertbellamy.com"] [uri "/.env.backup"] [unique_id "as2TFY_DX-4yEQWXSq8hpwAAAZg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 23:47:49
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 19:47:42.484277 2026] [security2:error] [pid 5316:tid 5316] [client 162.158.23.80:12526] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 19:47:42.484277 2026] [security2:error] [pid 5316:tid 5316] [client 162.158.23.80:12526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aquatreat.net"] [uri "/.env.staging"] [unique_id "as1xnmH4N65kf1d41dytigAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 11:21:07
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 07:20:58.566728 2026] [security2:error] [pid 22748:tid 22748] [client 162.158.23.80:9318] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 07:20:58.566728 2026] [security2:error] [pid 22748:tid 22748] [client 162.158.23.80:9318] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daretownkindling.com"] [uri "/.env.bak"] [unique_id "astxGkGFYIH3uuH2buW4vwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:14:03
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:13:54.031351 2026] [security2:error] [pid 27311:tid 27311] [client 162.158.23.80:11582] M ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:13:54.031351 2026] [security2:error] [pid 27311:tid 27311] [client 162.158.23.80:11582] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "savingspools.com"] [uri "/.env.production"] [unique_id "asri0ulUO8dR-mW1YtRtkgAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 02:05:54
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 22:05:31.914312 2026] [security2:error] [pid 1219:tid 1219] [client 162.158.23.80:13069] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.23.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 22:05:31.914312 2026] [security2:error] [pid 1219:tid 1219] [client 162.158.23.80:13069] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||developerdove.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "developerdove.com"] [uri "/index.php.bak"] [unique_id "asmda7bpHYuBCrdiBi9TMAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Jacqb
2026-09-21 21:31:44
UTC ·
(1 month ago)
Adres potencjalnie niebezpieczny
Brute-Force
Web App Attack
Bad Web Bot
🇩🇪
abdubhai
2026-06-01 11:19:40
UTC ·
(5 months ago)
162.158.23.80 - - [01/Jun/2026:1
...
Brute-Force
