🇳🇱
Alt255
2026-10-15 05:25:28
(1 day ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 65.111.9.5 - - [15/Oct/2026:07:24:37 +0200] "GET /docker/.env.orig HTTP/1.1" 301 6291 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-03 15:01:20
(1 week ago)
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 65.111.9.5 - - [03/Oct/2026:17:01:03 +0200] "GET /.aws/credentials HTTP/1.1" 404 12532 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
drewf.ink
2026-09-29 11:42:38
(2 weeks ago)
[11:42] Attempted HTTPS GlobalProtect login with credentials tpitts:W******1
Web App Attack
🇫🇷
Sklurk
2026-09-12 00:41:18
(1 month ago)
Web App Attack
Web App Attack
🇨🇿
lp
2026-09-04 12:21:52
(1 month ago)
Unauthorized VPN login attempts: 11 attempts were recorded from 65.111.9.5
2026-09-04T13:52:48+02:00 ...
show more
Unauthorized VPN login attempts: 11 attempts were recorded from 65.111.9.5
2026-09-04T13:52:48+02:00 vpn Access-Reject 'shubham' station: 65.111.9.5 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-04T13:56:17+02:00 vpn Access-Reject 'jay' station: 65.111.9.5 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-04T13:57:55+02:00 vpn Access-Reject 'jyoti' station: 65.111.9.5 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-04T13:59:46+02:00 vpn Access-Reject 'sanjay' station: 65.111.9.5 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-04T14:01:28+02:00 vpn Access-Reject 'rajendra' station: 65.111.9.5 auth-type: - realm: vse.cz nas: <redacted> called: <redacted
show less
Brute-Force
Web App Attack
🇫🇷
Sklurk
2026-07-30 00:09:46
(2 months ago)
Web App Attack
Web App Attack
🇺🇸
oncord
2026-03-17 03:58:20
(6 months ago)
Form spam
Web Spam
🇨🇭
backslash
2026-03-03 00:21:00
(7 months ago)
Web Spam
🇦🇺
oncord
2026-02-21 15:19:26
(7 months ago)
Form spam
Web Spam
🇺🇸
mnsf
2026-02-13 13:05:35
(8 months ago)
Scanning/Probing (23)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 08:18:03
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.9.5 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.9.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 03:17:55.499792 2026] [security2:error] [pid 15066:tid 15066] [client 65.111.9.5:34475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mentalmolecule.com"] [uri "/frontend/.env"] [unique_id "aY7eM7xVOAxCREJKZHA8GQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-02-13 04:43:04
(8 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 65.111.9.5 (US/United States/-): 1 ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 65.111.9.5 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
myagent.site
2026-02-13 03:25:19
(8 months ago)
Blocking for trying to access an exploit file: /.env
Hacking
🇺🇸
TPI-Abuse
2026-02-13 03:15:07
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.9.5 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.9.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 22:15:03.248381 2026] [security2:error] [pid 21745:tid 21745] [client 65.111.9.5:38559] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marcastecnologia.com"] [uri "/app/.env"] [unique_id "aY6XN6WILiuq6STle0UUEgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 01:45:27
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.9.5 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.9.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 20:45:16.291258 2026] [security2:error] [pid 2054095:tid 2054095] [client 65.111.9.5:12961] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mainefirst.org"] [uri "/.git/config"] [unique_id "aY6CLNgMIAqur-W2HAfkiwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack