2026-06-02 17:36:51
UTC ·
(5 months ago)
Portscan: TCP/2082, TCP/8443, TCP/8080, TCP/2086, TCP/2083, TCP/2087
Port Scan
🇫🇷
Hiigara
2026-06-02 14:00:46
UTC ·
(5 months ago)
connection attempt : 20.169.72.21 on port : tcp/8080 (HTTP-alt)
Port Scan
🇹🇭
Sawasdee
2026-06-02 13:57:08
UTC ·
(5 months ago)
Unwanted checking 80 or 443 port
...
Bad Web Bot
🇺🇸
xxkodedxx
2026-06-02 13:37:36
UTC ·
(5 months ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 5× edge-block in 10m window.
Origin: US / AS8075 Microsoft Corporation
Active: 13:37:19→13:37:34 UTC
Volume: 5 HTTP req, 4 honeypot probe(s)
Bait taken: /.env.save, ...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 5× edge-block in 10m window.
Origin: US / AS8075 Microsoft Corporation
Active: 13:37:19→13:37:34 UTC
Volume: 5 HTTP req, 4 honeypot probe(s)
Bait taken: /.env.save, /.env.production, /.env.local, /.env
Status mix: 444×5
Vhost fishing: 67.217.240.72
UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇺🇸
etu brutus
2026-06-02 13:26:29
UTC ·
(5 months ago)
20.169.72.21 Blocked by [Attack Vector List]
...
Hacking
Brute-Force
Exploited Host
🇫🇷
ISPLtd
2026-06-02 13:25:45
UTC ·
(5 months ago)
Jun 2 10:25:45 20.169.72.21 TCP SPT=51897 DPT=2087 SYN
Jun 2 10:25:45 20.169.72.21 TCP SPT=52312 DPT=2083 SYN
Jun 2 10:25:45 20.169.72.21 TCP SPT=52036 DPT=2082
...
Port Scan
🇺🇸
MPL
2026-06-02 13:00:01
UTC ·
(5 months ago)
tcp port scan (8 or more attempts)
Port Scan
🇺🇸
TPI-Abuse
2026-06-02 12:50:37
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 20.169.72.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:50:31.373721 2026] [security2:error] [pid 25634:tid 25634] [client 20.169.72.21:51262] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 20.169.72.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:50:31.373721 2026] [security2:error] [pid 25634:tid 25634] [client 20.169.72.21:51262] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.12"] [uri "/.git/HEAD"] [unique_id "ah7Rl0mX0wU-6KvEqicZxgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 12:24:18
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 20.169.72.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:24:12.356739 2026] [security2:error] [pid 11898:tid 11898] [client 20.169.72.21:51397] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 20.169.72.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:24:12.356739 2026] [security2:error] [pid 11898:tid 11898] [client 20.169.72.21:51397] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.108"] [uri "/.git/HEAD"] [unique_id "ah7LbMjPNUM4Eic87p1EAwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rip
2026-06-02 11:17:56
UTC ·
(5 months ago)
Restricted File Access Attempts
Port Scan
Web App Attack
🇧🇾
lns.bz
2026-06-02 10:51:14
UTC ·
(5 months ago)
Too many 404 requests [BY]
Web App Attack
🇫🇮
6kilowatti
2026-06-02 10:45:45
UTC ·
(5 months ago)
2026-06-02T13:45:45.532050+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:fd:74:70:71:9e:08:00 SRC=20.169.72.21 DST=10.0.0.30 LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=53929 DF PROTO=TCP SPT=51846 DPT=2087 WINDOW=64240 RES=0x00 SYN ...
show more
2026-06-02T13:45:45.532050+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:fd:74:70:71:9e:08:00 SRC=20.169.72.21 DST=10.0.0.30 LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=53929 DF PROTO=TCP SPT=51846 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-02 09:54:32
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 20.169.72.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 05:54:27.775225 2026] [security2:error] [pid 1943:tid 1943] [client 20.169.72.21:52754] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 20.169.72.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 05:54:27.775225 2026] [security2:error] [pid 1943:tid 1943] [client 20.169.72.21:52754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.208"] [uri "/.git/config"] [unique_id "ah6oU3wQO5zB3bz8xmqnmQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
evilrave
2026-06-02 09:32:08
UTC ·
(5 months ago)
20.169.72.21 - - [02/Jun/2026:09:32:08 +0000] "GET /.git/HEAD HTTP/1.1" 444 0 Host="[REDACTED_IP]" SNI="-"
...
Bad Web Bot
🇲🇾
Rizzy
2026-06-02 08:41:14
UTC ·
(5 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack