ban-reviewer auto report; ip=45.61.97.156; scenario=http:scan; verdict=valid_ban; confidence=0.85; c ...
show moreban-reviewer auto report; ip=45.61.97.156; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18,22; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=IP flagged for 'http:scan' scenario; Decision is a ban with duration of 7920 minutes (5.5 days); AbuseIPDB categories include Port Scan (14), Hacking (15), Brute-Force (18), SSH (22) which align with scan/exploit patterns
show less
Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" ...
show moreAttempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" resources improperly exposed externally and "protected" only by a lack of external DNS resolution.
45.61.97.156 - - [16/Jan/2026:14:49:12 +0000] "GET /.env HTTP/1.1" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" "-"
show less
Malicious IP detected by WAF with anomaly score 10.0. Attack types: Exposure of environment file (.e ...
show moreMalicious IP detected by WAF with anomaly score 10.0. Attack types: Exposure of environment file (.env), Timestamp deviates by 1.3 hours, Suspicious short random path (+1 more). Activity: 210 requests to 2 URLs. Time: 2025-08-16 11:34:08 (America/Bogota). Origin: US. Source: Automated WAF log analysis.
show less