🇺🇸
ctrlpew
2026-05-19 01:01:03
(2 weeks ago)
WordPress login brute-force botnet targeting ctrlpew.com. Distributed IPs cycling every 3 seconds wi ...
show more
WordPress login brute-force botnet targeting ctrlpew.com. Distributed IPs cycling every 3 seconds with UA rotation. All attempts against non-existent usernames. 2026-05-18.
show less
Brute-Force
Web App Attack
🇦🇺
RedBear IT
2026-03-26 10:00:37
(2 months ago)
"DDoS against public endpoint"
DDoS Attack
🇳🇱
jjnxpct
2026-02-19 04:50:40
(3 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ...
show more
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env.production (Rule ID: 930130) - Restricted File Access Attempt
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-02-18 03:46:13
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 17 22:46:04.744701 2026] [security2:error] [pid 2019:tid 2019] [client 65.111.13.66:59721] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robcruickshank.com"] [uri "/config/.env"] [unique_id "aZU1_LNf_g0h-AdxUy3E9QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 02:29:48
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 17 21:29:44.096690 2026] [security2:error] [pid 8735:tid 8735] [client 65.111.13.66:62035] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "renperfco.com"] [uri "/config/.env"] [unique_id "aZUkGD8NtjyQ3lMDgChtUQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 00:53:00
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 17 19:52:50.353280 2026] [security2:error] [pid 1506832:tid 1506832] [client 65.111.13.66:45399] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pawlewicz.org"] [uri "/.env.staging"] [unique_id "aZUNYiH9LMHemDF-Preb2gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
etu brutus
2026-02-09 21:05:49
(3 months ago)
65.111.13.66 has been banned for [WebApp Attack]
...
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 19:48:03
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 14:47:54.378689 2026] [security2:error] [pid 717735:tid 717756] [client 65.111.13.66:30201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gafm.org"] [uri "/frontend/.env"] [unique_id "aYo56le2saaLoPBOZVo6yQAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-02-09 19:10:37
(3 months ago)
Blocking for trying to access an exploit file: /.env.local
Hacking
🇺🇸
TPI-Abuse
2026-02-09 09:54:21
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 04:54:14.331873 2026] [security2:error] [pid 1378874:tid 1378874] [client 65.111.13.66:51245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gabbyspetnanny.com"] [uri "/.env.staging"] [unique_id "aYmuxiT4bT3Bu86QaGWMTAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 09:06:00
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.13.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 04:05:48.937209 2026] [security2:error] [pid 17548:tid 17548] [client 65.111.13.66:19133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "g-peopleland.com"] [uri "/dev/.git/config"] [unique_id "aYmjbEPjwTw8r-rNG-BZuAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
tilellit.pro
2026-01-20 01:59:02
(4 months ago)
Fail2Ban banned 65.111.13.66 for security violations in jail wp-armour. Log: 2026/01/20 01:59:01 [er ...
show more
Fail2Ban banned 65.111.13.66 for security violations in jail wp-armour. Log: 2026/01/20 01:59:01 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 65.111.13.66 | Target: wplogin" , client: 65.111.13.66, server: [REDACTED], request: "POST /wp-login.php HTTP/2.0", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇧🇪
DrLex0
2026-01-09 00:33:30
(4 months ago)
Suspect single hit only to guestbook page prohibited by robots.txt, from multiple IPs in the same ra ...
show more
Suspect single hit only to guestbook page prohibited by robots.txt, from multiple IPs in the same ranges owned by DREI-K-TECH-GMBH, DE
show less
Bad Web Bot
2025-12-22 14:46:33
(5 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
2025-12-09 23:42:21
(5 months ago)
botnet
DDoS Attack