2026-10-05 20:58:39
(4 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
Skyrider
2026-09-17 03:20:08
(2 weeks ago)
Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.
Bad Web Bot
Web App Attack
🇸🇪
OnTheEdge
2026-09-04 02:17:56
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇩🇪
NxtGenIT
2026-09-03 10:43:20
(1 month ago)
CiscoASA Honeypot hit, Payload: "GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1" 200 -,
Brute-Force
🇫🇷
Sklurk
2026-08-14 09:36:13
(1 month ago)
Web App Attack
Web App Attack
🇦🇺
gregoo23
2026-06-05 04:19:29
(4 months ago)
65.111.20.74 - - [05/Jun/2026:14:19:28 +1000] "GET /wp-content/plugins/paid-memberships-pro/readme.t ...
show more
65.111.20.74 - - [05/Jun/2026:14:19:28 +1000] "GET /wp-content/plugins/paid-memberships-pro/readme.txt HTTP/1.1" 404 116530 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
65.111.20.74 - - [05/Jun/2026:14:19:28 +1000] "GET /wp-content/plugins/sitepress-multilingual-cms/readme.txt HTTP/1.1" 404 116522 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
65.111.20.74 - - [05/Jun/2026:14:19:28 +1000] "GET /wp-content/plugins/ultimate-member/readme.txt HTTP/1.1" 404 116545 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-05-27 23:31:13
(4 months ago)
[Thu May 28 09:31:13.410577 2026] [security2:error] [pid 504829] [client 65.111.20.74:48175] [client ...
show more
[Thu May 28 09:31:13.410577 2026] [security2:error] [pid 504829] [client 65.111.20.74:48175] [client 65.111.20.74] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "iaki.com.au"] [uri "/.wp-config.php.swp"] [unique_id "ahd-wayVIc7vshGgaXrv6QAAAA0"]
...
show less
Web App Attack
🇺🇸
MPL
2026-02-10 17:41:42
(7 months ago)
tcp/80 (8 or more attempts)
Port Scan
🇺🇸
MPL
2026-02-10 17:41:42
(7 months ago)
tcp/80 (16 or more attempts)
Port Scan
🇺🇸
TPI-Abuse
2026-02-10 02:28:00
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:27:52.712282 2026] [security2:error] [pid 12557:tid 12557] [client 65.111.20.74:31795] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kimmimorikawa.com"] [uri "/dev/.git/config"] [unique_id "aYqXqFNaRNDzZLDv8y6tLQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 23:28:37
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 18:28:32.783776 2026] [security2:error] [pid 26891:tid 26891] [client 65.111.20.74:23833] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "keithbowles.com"] [uri "/api/.git/config"] [unique_id "aYptoH-UrU635l1cMG9o0AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-02-09 22:59:22
(7 months ago)
Auto-ban: >3000 req/min op 2026-02-09
Hacking
Web App Attack
SSH
🇺🇸
TPI-Abuse
2026-02-09 22:38:04
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:37:58.321468 2026] [security2:error] [pid 10698:tid 10698] [client 65.111.20.74:14689] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "macroprintbooks.com"] [uri "/admin/.env"] [unique_id "aYphxgDYSqhEI-3TPKKyjgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 20:51:56
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.20.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 15:51:46.572550 2026] [security2:error] [pid 1442836:tid 1442836] [client 65.111.20.74:26273] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hookedupfishing.net"] [uri "/.env.local"] [unique_id "aYpI4kKhOhvTViBu1gKKsAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-24 21:29:51
(9 months ago)
Forum/form spam
Web Spam
