🇺🇸
Jason Howell
2026-06-13 15:27:32
(2 days ago)
65.111.0.79 - - [13/Jun/2026:09:55:46 -0500] "GET /wp-login.php HTTP/1.1" 200 5865 "https://www.goog ...
show more
65.111.0.79 - - [13/Jun/2026:09:55:46 -0500] "GET /wp-login.php HTTP/1.1" 200 5865 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
65.111.0.79 - - [13/Jun/2026:09:55:46 -0500] "POST /wp-login.php HTTP/1.1" 200 5965 "https://abstractco.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
65.111.0.79 - - [13/Jun/2026:09:55:47 -0500] "GET /wp-admin/ HTTP/1.1" 302 4189 "https://abstractco.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
65.111.0.79 - - [13/Jun/2026:09:55:48 -0500] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.abstractco.com%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 8026 "https://abstractco.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
65.111.0.79 - - [13/Jun/2026:10:27:31 -0500] "G
...
show less
Web App Attack
2026-03-29 05:12:19
(2 months ago)
Forum/form spam
Web Spam
2026-03-12 13:53:29
(3 months ago)
Forum/form spam
Web Spam
2026-02-15 16:31:08
(4 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇫🇷
dynamix
2026-02-15 12:42:56
(4 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 12:37:40
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:37:37.025635 2026] [security2:error] [pid 20747:tid 20747] [client 65.111.0.79:47755] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pascoyardsale.com"] [uri "/config/.env"] [unique_id "aZG-EZHZORUW_wF2O3t2DwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 11:46:11
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:46:08.991190 2026] [security2:error] [pid 635:tid 635] [client 65.111.0.79:42091] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "page-wide.com"] [uri "/api/.env"] [unique_id "aZGyAJJtG5bgeszKr7ip8gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 11:27:04
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:27:00.131515 2026] [security2:error] [pid 22165:tid 22165] [client 65.111.0.79:44983] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oxford-gliding-club.co.uk"] [uri "/dev/.git/config"] [unique_id "aZGthAPZQGlww8vWWkE8zAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-02-15 11:21:19
(4 months ago)
Blocking for trying to access an exploit file: /frontend/.env
Hacking
🇺🇸
mnsf
2026-02-15 07:05:38
(4 months ago)
Scanning/Probing (23)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 07:02:48
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 02:02:44.240903 2026] [security2:error] [pid 980737:tid 980737] [client 65.111.0.79:37863] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "origenial.com"] [uri "/.env"] [unique_id "aZFvlPllW94dDJCU9MawWwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 05:40:28
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 00:40:21.417422 2026] [security2:error] [pid 469:tid 469] [client 65.111.0.79:57335] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "okwellbeing.com"] [uri "/dev/.git/config"] [unique_id "aZFcRarRO-VeQFqlshVvygAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 04:58:28
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 23:58:22.091669 2026] [security2:error] [pid 30928:tid 30928] [client 65.111.0.79:59279] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prestigedomainsales.com"] [uri "/.env.production"] [unique_id "aZFSbq5PUMC3pLiRq6evOQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 03:39:50
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.0.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 22:39:44.543348 2026] [security2:error] [pid 29682:tid 29682] [client 65.111.0.79:31237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "noramsg.com"] [uri "/app/.env"] [unique_id "aZFAALqJGe0eshswlQhRkgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
kumiko
2026-02-15 02:57:15
(4 months ago)
[2026-02-15 04:57:14] Probing for dotfiles
"GET /frontend/.env HTTP/1.1" 301
Bad Web Bot
Web App Attack