🇺🇸
RAP
2026-06-29 13:50:14
(1 week ago)
2026-06-29 13:50:14 UTC Unauthorized activity to TCP port 8443. Web App
Port Scan
Web App Attack
2026-06-29 11:08:54
(1 week ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇧🇾
lns.bz
2026-06-29 10:58:06
(1 week ago)
Too many 404 requests [BY]
Web App Attack
🇳🇴
jad-abuse
2026-06-17 01:19:46
(2 weeks ago)
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure ...
show more
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, env_probe, config_backup, aws_creds, actuator, ssh_keys. Observed by 1 sensor(s); 94 hits.
show less
Hacking
Web App Attack
🇫🇷
sthoyer.de
2026-06-17 00:47:29
(2 weeks ago)
Jun 17 02:47:29 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ...
show more
Jun 17 02:47:29 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.161.69.68 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=15434 DF PROTO=TCP SPT=42256 DPT=2082 WINDOW=64240 RES=0x00 SYN URGP=0
Jun 17 02:47:29 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.161.69.68 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=193 DF PROTO=TCP SPT=42247 DPT=2083 WINDOW=64240 RES=0x00 SYN URGP=0
Jun 17 02:47:29 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.161.69.68 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=16714 DF PROTO=TCP SPT=42246 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0
Jun 17 02:47:29 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.161.69.68 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=34910 DF PROTO=TCP SPT=42251 DPT=2086 WINDOW=64240
...
show less
Port Scan
🇷🇸
Scan
2026-06-17 00:28:25
(2 weeks ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
🇩🇪
ISPLtd
2026-06-17 00:08:15
(2 weeks ago)
Jun 16 21:08:14 20.161.69.68 TCP SPT=42319 DPT=2082 SYN
Jun 16 21:08:14 20.161.69.68 TCP SPT=42333 D ...
show more
Jun 16 21:08:14 20.161.69.68 TCP SPT=42319 DPT=2082 SYN
Jun 16 21:08:14 20.161.69.68 TCP SPT=42333 DPT=2087 SYN
Jun 16 21:08:14 20.161.69.68 TCP SPT=42305 DPT=2095
...
show less
Port Scan
🇺🇸
mutebot.net
2026-06-17 00:07:33
(2 weeks ago)
SRC=20.161.69.68, PROTO=TCP, SPT=42319, DPT=2078
SRC=20.161.69.68, PROTO=TCP, SPT=42321, DPT=2095
SR ...
show more
SRC=20.161.69.68, PROTO=TCP, SPT=42319, DPT=2078
SRC=20.161.69.68, PROTO=TCP, SPT=42321, DPT=2095
SRC=20.161.69.68, PROTO=TCP, SPT=42342, DPT=2086
SRC=20.161.69.68, PROTO=TCP, SPT=42307, DPT=2077
SRC=20.161.69.68, PROTO=TCP, SPT=42320, DPT=2083
show less
Port Scan
🇧🇾
lns.bz
2026-06-16 23:35:13
(2 weeks ago)
Too many 404 requests [BY]
Web App Attack
🇺🇸
MPL
2026-06-16 23:12:04
(2 weeks ago)
tcp port scan (15 or more attempts)
Port Scan
2026-06-16 22:38:04
(2 weeks ago)
Honeypot hit: Empty payload (likely service probe); 2082 [1], 2087 [1], 2096 [1], 2078 [1] TCP
Repor ...
show more
Honeypot hit: Empty payload (likely service probe); 2082 [1], 2087 [1], 2096 [1], 2078 [1] TCP
Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB
show less
Port Scan
🇺🇸
Axel
2026-06-16 19:46:23
(2 weeks ago)
Blocked by UFW on MVI [443/tcp] | SPT: 42017 | TTL: 48 | LEN: 60 | TOS: 0x00 • Reported by: github.c ...
show more
Blocked by UFW on MVI [443/tcp] | SPT: 42017 | TTL: 48 | LEN: 60 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-16 07:59:40
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 20.161.69.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 20.161.69.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 03:59:36.170739 2026] [security2:error] [pid 1941:tid 1941] [client 20.161.69.68:13575] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.17"] [uri "/.git/HEAD"] [unique_id "ajECaKbBh7miTGEuFZ0DYQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
urnilxfgbez
2026-06-03 22:45:00
(1 month ago)
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
Port Scan
🇷🇸
Scan
2026-06-03 02:33:11
(1 month ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking