🇹🇷
Threat.live
2026-06-04 13:45:08
(1 day ago)
Threat.live: Web Scan
Web App Attack
🇺🇸
troublesome
2026-06-04 13:43:55
(1 day ago)
lily
Port Scan
Web App Attack
🇦🇹
urnilxfgbez
2026-06-02 22:45:00
(3 days ago)
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
Port Scan
🇪🇸
Francisco Vallejo
2026-06-02 21:53:54
(3 days ago)
[Tue Jun 02 23:53:36.816345 2026] [core:info] [pid 274070:tid 130565915268800] [client 20.81.159.6:2 ...
show more
[Tue Jun 02 23:53:36.816345 2026] [core:info] [pid 274070:tid 130565915268800] [client 20.81.159.6:29734] AH00128: File does not exist: /var/www/franvallejo/.env
[Tue Jun 02 23:53:38.622787 2026] [core:info] [pid 274070:tid 130567198729920] [client 20.81.159.6:29722] AH00128: File does not exist: /var/www/franvallejo/.env.local
[Tue Jun 02 23:53:48.261934 2026] [core:info] [pid 274070:tid 130566594750144] [client 20.81.159.6:29121] AH00128: File does not exist: /var/www/franvallejo/wp-config.php
[Tue Jun 02 23:53:52.868058 2026] [core:info] [pid 274070:tid 130565797836480] [client 20.81.159.6:29737] AH00128: File does not exist: /var/www/franvallejo/wp-config.php.bak
[Tue Jun 02 23:53:54.264162 2026] [core:info] [pid 274070:tid 130567165159104] [client 20.81.159.6:29707] AH00128: File does not exist: /var/www/franvallejo/.aws/credentials
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-02 21:50:50
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 20.81.159.6 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.81.159.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 17:50:47.044340 2026] [security2:error] [pid 7359:tid 7359] [client 20.81.159.6:30125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.76"] [uri "/.git/config"] [unique_id "ah9QN-RG6IczCRUGS05aogAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 21:06:55
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 20.81.159.6 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.81.159.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 17:06:51.640969 2026] [security2:error] [pid 19612:tid 19689] [client 20.81.159.6:29547] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.85"] [uri "/.env"] [unique_id "ah9F6zlAvlpRr4BMloR-SAAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
XICTRON
2026-06-02 21:00:04
(3 days ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇬🇧
PeravixGroup
2026-06-02 20:01:39
(3 days ago)
Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ...
show more
Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud
show less
Port Scan
Bad Web Bot
2026-06-02 19:52:45
(3 days ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇫🇷
GabrielJST
2026-06-02 19:24:49
(3 days ago)
*Port Scan* detected from 20.81.159.6 (US/United States/-).
Port Scan
🇺🇸
mnsf
2026-06-02 19:06:06
(3 days ago)
Too many Status 50X (11)
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-06-02 18:25:13
(3 days ago)
Multiple WAF Violations
Web App Attack
🇦🇷
Bruno
2026-06-02 18:08:05
(3 days ago)
Port Scanner: 20.81.159.6
Port Scan
🇺🇸
TPI-Abuse
2026-06-02 18:01:17
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 20.81.159.6 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.81.159.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 14:01:12.142297 2026] [security2:error] [pid 25094:tid 25103] [client 20.81.159.6:29537] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.131"] [uri "/.git/HEAD"] [unique_id "ah8aaBDkcBrMDpVXdV9EkAAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
MPL
2026-06-02 17:04:12
(3 days ago)
tcp port scan (8 or more attempts)
Port Scan