🇳🇱
BellFix
2026-05-22 14:31:36
(3 weeks ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇳🇱
BellFix
2026-05-19 16:16:16
(4 weeks ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇳🇱
BellFix
2026-05-12 01:33:52
(1 month ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇳🇱
BellFix
2026-04-09 11:12:58
(2 months ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇷🇺
BellFix
2026-03-30 17:19:42
(2 months ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇳🇱
BellFix
2026-03-29 06:06:38
(2 months ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇷🇺
BellFix
2026-03-05 09:55:57
(3 months ago)
Fail2ban reported 213.176.79.65 for npm-docker
Web App Attack
🇷🇺
6o6ep
2026-02-21 04:50:10
(3 months ago)
Automatic report from firewall log
Port Scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-02-20 15:35:41
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 213.176.79.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 213.176.79.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 10:35:35.235287 2026] [security2:error] [pid 6180:tid 6180] [client 213.176.79.65:52834] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "zeetec.nl"] [uri "/wp-content/uploads/.env"] [unique_id "aZh_R_j6Ghx4kGxBOqqmYAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
loveprod
2026-02-20 01:48:35
(3 months ago)
213.176.79.65 - - [20/Feb/2026:04:48:35 +0300] "GET /.env HTTP/1.1" 403 4365 "-" "Mozilla/5.0 (Windo ...
show more
213.176.79.65 - - [20/Feb/2026:04:48:35 +0300] "GET /.env HTTP/1.1" 403 4365 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
213.176.79.65 - - [20/Feb/2026:04:48:35 +0300] "GET /wp-content/uploads/.env.old HTTP/1.1" 403 4364 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
🇷🇺
DobriyDenis
2026-02-19 16:25:53
(3 months ago)
\[Thu Feb 19 19:25:27.223098 2026\] \[access_compat:error\] \[pid 27219\] \[client 213.176.79.65:410 ...
show more
\[Thu Feb 19 19:25:27.223098 2026\] \[access_compat:error\] \[pid 27219\] \[client 213.176.79.65:41026\] AH01797: client denied by server configuration: /home/gtlinkru/gtlinkru/wp-content/updraft/.env
\[Thu Feb 19 19:25:27.223098 2026\] \[access_compat:error\] \[pid 27282\] \[client 213.176.79.65:41024\] AH01797: client denied by server configuration: /home/gtlinkru/gtlinkru/wp-content/updraft/.env.bak
\[Thu Feb 19 19:25:27.888041 2026\] \[access_compat:error\] \[pid 27274\] \[client 213.176.79.65:41080\] AH01797: client denied by server configuration: /home/gtlinkru/gtlinkru/wp-content/updraft/.env.old
\[Thu Feb 19 19:25:29.590274 2026\] \[access_compat:error\] \[pid 27220\] \[client 213.176.79.65:58910\] AH01797: client denied by server configuration: /home/gtlinkru/gtlinkru/wp-content/updraft/.env.save
\[Thu Feb 19 19:25:29.647294 2026\] \[access_compat:error\] \[pid 30754\] \[client 213.176.79.65:58962\] AH01797: client denied by server configuration: /home/gtlinkru/gtlinkru/wp-con
...
show less
DDoS Attack
Web App Attack
🇧🇪
cmbplf
2026-02-19 13:47:53
(3 months ago)
120 requests with url.path *.sql.gz
Brute-Force
Bad Web Bot
🇷🇺
antihack.anarchista.xyz
2026-02-19 12:38:01
(3 months ago)
404 burst: 20 hits in 5 min, URI /doktorvajicko.com.tar.gz, Ref , UA Mozilla/5.0 (Windows NT 10.0; W ...
show more
404 burst: 20 hits in 5 min, URI /doktorvajicko.com.tar.gz, Ref , UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
Brute-Force
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-19 10:25:46
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 213.176.79.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 213.176.79.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 19 05:25:41.322591 2026] [security2:error] [pid 26053:tid 26101] [client 213.176.79.65:39140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "byandlarge.nl"] [uri "/wp-admin/install.php/.env.bak"] [unique_id "aZblJeEaLJh9DXm5s8NcsgAAARM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-18 22:36:48
(3 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack