2026-10-08 17:16:20
(2 hours ago)
181.215.65.138 - - [08/Oct/2026:19:16:19 +0200] "GET /back/.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 ( ...
show more
181.215.65.138 - - [08/Oct/2026:19:16:19 +0200] "GET /back/.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
show less
Web App Attack
🇫🇷
guillaume illien
2026-10-08 09:46:30
(10 hours ago)
181.215.65.138 - - [08/Oct/2026:09:46:23 +0000] "HEAD /phpinfo.php HTTP/1.1" 301 0 "-" "Mozilla/5.0 ...
show more
181.215.65.138 - - [08/Oct/2026:09:46:23 +0000] "HEAD /phpinfo.php HTTP/1.1" 301 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0"
181.215.65.138 - - [08/Oct/2026:09:46:23 +0000] "GET /phpinfo.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0"
181.215.65.138 - - [08/Oct/2026:09:46:24 +0000] "HEAD /info.php HTTP/1.1" 301 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0"
181.215.65.138 - - [08/Oct/2026:09:46:25 +0000] "GET /info.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0"
181.215.65.138 - - [08/Oct/2026:09:46:26 +0000] "HEAD /owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php HTTP/1.1" 301 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0"
181.215.65.138 - - [08/Oct/2026:09:46:26 +0000] "GET /owncloud/apps/graphapi/vendor/microsoft/micro
...
show less
Hacking
Brute-Force
Web App Attack
SSH
🇦🇺
Starburst SysOp Team
2026-10-07 19:32:40
(1 day ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-syd2-4)
Hacking
Bad Web Bot
🇫🇷
Entalpi.net
2026-10-07 13:19:13
(1 day ago)
Repeated requests against sensitive web endpoints
Web App Attack
🇩🇪
gadix
2026-10-07 05:52:43
(1 day ago)
[07/Oct/2026:07:52:42.781804 +0200] asXeKtBJ2i2rGaeUqfYgywAAABg 181.215.65.138 42074 127.0.0.1 7081
...
show more
[07/Oct/2026:07:52:42.781804 +0200] asXeKtBJ2i2rGaeUqfYgywAAABg 181.215.65.138 42074 127.0.0.1 7081
[07/Oct/2026:07:52:42.896658 +0200] asXeKtBJ2i2rGaeUqfYgzAAAABE 181.215.65.138 42078 127.0.0.1 7081
...
show less
Web App Attack
🇩🇪
XICTRON
2026-10-07 04:45:37
(1 day ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇩🇪
big-cloud.nl
2026-10-07 04:21:10
(1 day ago)
Try to access /.env
Web App Attack
🇨🇦
Blinker73
2026-10-07 04:20:28
(1 day ago)
181.215.65.138 - - [07/Oct/2026:00:20:28 -0400] "GET /docker/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 ...
show more
181.215.65.138 - - [07/Oct/2026:00:20:28 -0400] "GET /docker/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
2026-10-07 03:48:03
(1 day ago)
2026-10-07T03:48:02.957053+00:00 gotosocial caddy[86195]: {"level":"info","ts":1791344882.956918,"lo ...
show more
2026-10-07T03:48:02.957053+00:00 gotosocial caddy[86195]: {"level":"info","ts":1791344882.956918,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"181.215.65.138","remote_port":"27513","client_ip":"181.215.65.138","proto":"HTTP/1.1","method":"GET","host":"142.132.177.172","uri":"/info.php","headers":{"Upgrade-Insecure-Requests":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Connection":["keep-alive"],"Content-Type":["application/json"],"Cache-Control":["max-age=0"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,en;q=0.5"]}},"bytes_read":0,"user_id":"","duration":0.000074001,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://142.132.177.172/info.php"],"Content-Type":[]}}
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 23:55:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 181.215.65.138 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.65.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 19:54:55.224122 2026] [security2:error] [pid 24946:tid 24946] [client 181.215.65.138:33655] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.147"] [uri "/storage/.env"] [unique_id "asWKT_x5wytwjSMALV10iwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 23:12:30
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 181.215.65.138 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.65.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 19:12:15.076599 2026] [security2:error] [pid 10782:tid 10802] [client 181.215.65.138:56459] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.127"] [uri "/blog/.env"] [unique_id "asWAT3n9LYMtoLlmMSJk0wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-01 03:44:35
(1 week ago)
427 requests with url.path //xmlrpc.php
Brute-Force
Bad Web Bot
🇵🇱
Budyn
2026-09-24 15:26:01
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vault.astropot.store | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-09 10:52:28
(4 weeks ago)
[09/Sep/2026:13:52:28 +0300] -- 181.215.65.138 Ban reason: Scanner [CMS_GENERIC] | Request: POST /wp ...
show more
[09/Sep/2026:13:52:28 +0300] -- 181.215.65.138 Ban reason: Scanner [CMS_GENERIC] | Request: POST /wp-admin/admin-ajax.php HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-08-12 15:06:48
(1 month ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
