2026-07-01 19:58:37
(1 day ago)
Fail2ban filtered
...
Web App Attack
2026-06-17 07:43:15
(2 weeks ago)
[ssd5.kdns.gr] httpd-login-spray-site: sites=ford-konstantinou.gr; logs=/var/log/httpd/domains/ford- ...
show more
[ssd5.kdns.gr] httpd-login-spray-site: sites=ford-konstantinou.gr; logs=/var/log/httpd/domains/ford-konstantinou.gr.log; samples=site_wide=true | distinct_ips=53 | /wp-login.php
show less
Hacking
Web App Attack
🇫🇷
ELYAZ
2026-06-16 19:58:03
(2 weeks ago)
(y4) Failed scan -byebye- from 65.111.6.221 (US/United States/-): (CF_ENABLE)
Hacking
🇫🇮
inlink.ltd
2026-05-25 22:23:36
(1 month ago)
Known malicious PHP file or CMS probe
Web App Attack
🇦🇺
RedBear IT
2026-03-26 10:00:37
(3 months ago)
"DDoS against public endpoint"
DDoS Attack
🇺🇸
TPI-Abuse
2026-02-11 23:50:43
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 18:50:34.905292 2026] [security2:error] [pid 26353:tid 26353] [client 65.111.6.221:51895] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arkml.com"] [uri "/admin/.env"] [unique_id "aY0Vyi60j5ohL0nRJKkWyAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-11 22:35:58
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 17:35:50.874801 2026] [security2:error] [pid 13868:tid 13868] [client 65.111.6.221:29857] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aridscapes.com"] [uri "/backend/.env"] [unique_id "aY0ERhDOd-JJKX4mwWa5jgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-11 20:12:21
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 15:12:14.663454 2026] [security2:error] [pid 12304:tid 12304] [client 65.111.6.221:42739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "architx.com"] [uri "/config/.env"] [unique_id "aYzinnfK5e3xNcig0Lq6WQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-02-10 22:59:43
(4 months ago)
Auto-ban: >3000 req/min op 2026-02-10
Hacking
Web App Attack
SSH
🇩🇪
big-cloud.nl
2026-02-10 22:28:09
(4 months ago)
Try to access /backend/.env
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 06:24:22
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 01:24:13.022762 2026] [security2:error] [pid 19929:tid 20022] [client 65.111.6.221:51561] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mailporte.com"] [uri "/app/.git/config"] [unique_id "aYrPDFn6EEqOJQgSnk0S8wAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 04:10:46
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:10:37.883726 2026] [security2:error] [pid 28361:tid 28361] [client 65.111.6.221:33685] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "icesoft.blog"] [uri "/.git/config"] [unique_id "aYqvvVl0PEnFj_VSWT_p9gAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 01:39:20
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 20:39:12.633960 2026] [security2:error] [pid 17753:tid 17753] [client 65.111.6.221:48853] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "macryder.com"] [uri "/app/.git/config"] [unique_id "aYqMQOQR3XC4tU9b8XLlcQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-09 22:45:54
(4 months ago)
File repository snooping:
65.111.6.221 - - [09/Feb/2026:22:37:00 +0000] "GET /site/.git/config HTTP ...
show more
File repository snooping:
65.111.6.221 - - [09/Feb/2026:22:37:00 +0000] "GET /site/.git/config HTTP/1.1" 404 253 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-01-17 10:39:18
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.6.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 05:39:12.410099 2026] [security2:error] [pid 22665:tid 22665] [client 65.111.6.221:47835] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kinnairdwoodworking.com"] [uri "/.env"] [unique_id "aWtm0HTJ5-6zDbaJlXd_KQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack