🇳🇱
93.123.109.230
29 Oct 2026
[Thu Oct 29 13:28:30.263635 2026] [:error] [pid 2216293:tid 2216441] [client 93.123.109.230:0] [clie ...
show more
[Thu Oct 29 13:28:30.263635 2026] [:error] [pid 2216293:tid 2216441] [client 93.123.109.230:0] [client 93.123.109.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 10 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.iwle.com"] [uri "/.aws/credentials"] [unique_id "auOCPopzsq5krHuQt6f2NgAAAFg"]
[Thu Oct 29 13:28:32.141359 2026] [:error] [pid 2216469:tid 2216515] [client 93.123.109.230:0] [client 93.123.109.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.ph
...
show less
Bad Web Bot
Web App Attack
🇺🇸
138.68.15.6
29 Oct 2026
[Thu Oct 29 12:38:41.452666 2026] [:error] [pid 2216293:tid 2216441] [client 138.68.15.6:45982] [cli ...
show more
[Thu Oct 29 12:38:41.452666 2026] [:error] [pid 2216293:tid 2216441] [client 138.68.15.6:45982] [client 138.68.15.6] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 10 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 23)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "63.141.255.191"] [uri "/+CSCOT+/oem-customization"] [unique_id "auN2kYpzsq5krHuQt6f1yAAAAFg"]
[Thu Oct 29 12:38:59.792568 2026] [:error] [pid 2216293:tid 2216434] [client 138.68.15.6:37562] [client 138.68.15.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.ph
...
show less
Bad Web Bot
Web App Attack
🇶🇦
34.18.188.158
29 Oct 2026
[Thu Oct 29 12:26:49.787195 2026] [:error] [pid 2216323:tid 2216451] [client 34.18.188.158:0] [clien ...
show more
[Thu Oct 29 12:26:49.787195 2026] [:error] [pid 2216323:tid 2216451] [client 34.18.188.158:0] [client 34.18.188.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "iwle.com"] [uri "/.env"] [unique_id "auNzySZR4MPphv__hom-bwAAAJA"]
[Thu Oct 29 12:26:50.400928 2026] [:error] [pid 2216469:tid 2216516] [client 34.18.188.158:0] [client 34.18.188.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[
...
show less
Bad Web Bot
Web App Attack
🇨🇳
120.26.162.58
29 Oct 2026
2026-10-29T12:20:19.119218 main.justuptowngames.com proftpd[2302109]: session[2302109] 0.0.0.0 (120. ...
show more
2026-10-29T12:20:19.119218 main.justuptowngames.com proftpd[2302109]: session[2302109] 0.0.0.0 (120.26.162.58[120.26.162.58]): USER root (Login failed): Incorrect password
2026-10-29T12:20:21.476190 main.justuptowngames.com proftpd[2302139]: session[2302139] 0.0.0.0 (120.26.162.58[120.26.162.58]): USER root (Login failed): Incorrect password
2026-10-29T12:20:24.162218 main.justuptowngames.com proftpd[2302171]: session[2302171] 0.0.0.0 (120.26.162.58[120.26.162.58]): USER root (Login failed): Incorrect password
2026-10-29T12:20:26.952162 main.justuptowngames.com proftpd[2302222]: session[2302222] 0.0.0.0 (120.26.162.58[120.26.162.58]): USER root (Login failed): Incorrect password
2026-10-29T12:20:29.526941 main.justuptowngames.com proftpd[2302255]: session[2302255] 0.0.0.0 (120.26.162.58[120.26.162.58]): USER root (Login failed): Incorrect password
...
show less
Brute-Force
FTP Brute-Force
🇭🇰
47.76.58.95
29 Oct 2026
2026-10-29T12:17:28.284530 main.justuptowngames.com postfix/smtpd[2299177]: improper command pipelin ...
show more
2026-10-29T12:17:28.284530 main.justuptowngames.com postfix/smtpd[2299177]: improper command pipelining after CONNECT from unknown[47.76.58.95]: \026\003\001\002\000\001\000\001\374\003\0038\342\276#\273\025\240\036\366?\331W\301\374\347\273\275\034\224\312rXHd\237\017\220\205\303]\030p \t\234\264\200[2\260\321\277\221+\376\027\314 I\302W,\323\276\263V\300wkb\304\235\221\252\f\0000\023\002\023\003\023\001\300,\3000\314\251\314\250\300+\300/\300$\300(
2026-10-29T12:17:28.942435 main.justuptowngames.com postfix/smtpd[2299209]: improper command pipelining after CONNECT from unknown[47.76.58.95]: \026\003\001\000u\001\000\000q\003\003\026\003\001\000u\001\000\000q\003\003\026\003\001\000u\001\000\000q\003\003\026\003\001\000u\001\000\000q\003\000\000\032\300/\300+\300\021\300\a\300\023\300\t\300\024\300\n\000\005\000/\0005\300\022\000\n\001\000\000.\000\005\000\005\001\000\000\000\000\000\n\000\b\000\006\000\027\000\030\000\031\000\v\000
2026-10-29T12:17:32.435446 main.justuptowngames.com
...
show less
Brute-Force
🇧🇪
35.187.95.42
29 Oct 2026
[Thu Oct 29 11:54:52.584901 2026] [:error] [pid 2216323:tid 2216444] [client 35.187.95.42:52750] [cl ...
show more
[Thu Oct 29 11:54:52.584901 2026] [:error] [pid 2216323:tid 2216444] [client 35.187.95.42:52750] [client 35.187.95.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "www.app.iwle.com"] [uri "/.env"] [unique_id "auNsTCZR4MPphv__hom-WQAAAIk"]
[Thu Oct 29 11:54:53.272487 2026] [:error] [pid 2216293:tid 2216435] [client 35.187.95.42:52756] [client 35.187.95.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.
...
show less
Bad Web Bot
Web App Attack
🇵🇰
202.142.147.123
29 Oct 2026
[Thu Oct 29 11:53:46.062855 2026] [:error] [pid 2216469:tid 2216499] [client 202.142.147.123:0] [cli ...
show more
[Thu Oct 29 11:53:46.062855 2026] [:error] [pid 2216469:tid 2216499] [client 202.142.147.123:0] [client 202.142.147.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)^/(?:wp-admin(?:/|$)|wp-content(?:/|$)|wp-includes(?:/|$)|wp-login\\\\.php$|wp-editor\\\\.php$|wp-mail\\\\.php$|xmlrpc\\\\.php$)" at REQUEST_URI. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "152"] [id "100114"] [msg "Local Policy: WordPress probe on non-WordPress site"] [severity "WARNING"] [tag "local/wordpress-probe"] [hostname "justuptowngames.com"] [uri "/wp-content/plugins/divi-form-builder/changelog.txt"] [unique_id "auNsCvfmhsTdLXEG_BzVmAAAAMI"]
[Thu Oct 29 11:53:46.722980 2026] [:error] [pid 2216323:tid 2216446] [client 202.142.147.123:0] [client 202.142.147.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)^/(?:wp-admin(?:/|$)|wp-content(?:/|$)|wp-includes(?:/|$)|wp-login\\\\.php$|wp-editor\\\\.php$|wp-mail\\\\.php$|xmlrpc\\\\.php$)"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
45.138.12.65
29 Oct 2026
[Thu Oct 29 11:43:41.541333 2026] [:error] [pid 2216279:tid 2216351] [client 45.138.12.65:0] [client ...
show more
[Thu Oct 29 11:43:41.541333 2026] [:error] [pid 2216279:tid 2216351] [client 45.138.12.65:0] [client 45.138.12.65] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dashboard.iwle.com"] [uri "/static../.git/config"] [unique_id "auNpracu100j9xgG_adCRQAAABE"]
[Thu Oct 29 11:43:41.543797 2026] [:error] [pid 2216279:tid 2216337] [client 45.138.12.65:0] [client 45.138.12.65] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-A
...
show less
Web App Attack
Brute-Force
🇳🇱
34.90.250.157
29 Oct 2026
[Thu Oct 29 11:31:23.848168 2026] [:error] [pid 2216279:tid 2216368] [client 34.90.250.157:0] [clien ...
show more
[Thu Oct 29 11:31:23.848168 2026] [:error] [pid 2216279:tid 2216368] [client 34.90.250.157:0] [client 34.90.250.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "ufscards.com"] [uri "/.env"] [unique_id "auNmy6cu100j9xgG_adB-AAAABY"]
[Thu Oct 29 11:31:24.361419 2026] [:error] [pid 2216323:tid 2216427] [client 34.90.250.157:0] [client 34.90.250.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\
...
show less
Bad Web Bot
Web App Attack
🇰🇷
118.194.248.4
29 Oct 2026
2026-10-29T11:10:07.533142 main.justuptowngames.com postfix/smtpd[2241852]: improper command pipelin ...
show more
2026-10-29T11:10:07.533142 main.justuptowngames.com postfix/smtpd[2241852]: improper command pipelining after CONNECT from unknown[118.194.248.4]: \026\003\001\000\374\001\000\000\370\003\0034\273\264\252S\207\002\324\022\361q3\f\364\001{\300\347,\225*\344Tu\005dLq\252\a\204\360 \272\317\t\222\322\326\036\231Zs\317\375G\232f\000J\334\3548\251S"\253\ahM\344\252\f\bk\0004\314\250\314\251\300/\3000\300+\300,\300\t\000\236\314\250\314\252\0003
2026-10-29T11:10:27.395209 main.justuptowngames.com postfix/smtpd[2242659]: improper command pipelining after CONNECT from unknown[118.194.248.4]: \026\003\001\000\306\001\000\000\302\003\003\271\300\204*5\260\276\240\003\3117\317\331\020\205\361\203mN\3054\254\336\241*\342\370\333\375\3569\263 \337\313\201BqW>\037\272^\223\022\3018dj\313 !\027\260\345G\201F5\341\326h\236O\275\000.\314\250\314\251\300/\3000\300+\300,\300\t\000\236\314\250\314\252\0003
2026-10-29T11:10:28.625603 main.justuptowngames.com postfix/smtpd[2241852]: improper command pipelin
...
show less
Brute-Force
🇬🇧
157.245.36.108
29 Oct 2026
[Thu Oct 29 10:38:40.827675 2026] [:error] [pid 2216469:tid 2216499] [client 157.245.36.108:59994] [ ...
show more
[Thu Oct 29 10:38:40.827675 2026] [:error] [pid 2216469:tid 2216499] [client 157.245.36.108:59994] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "main.justuptowngames.com"] [uri "/.env"] [unique_id "auNacPfmhsTdLXEG_BzUWAAAAMI"]
[Thu Oct 29 10:38:50.895113 2026] [:error] [pid 2216279:tid 2216340] [client 157.245.36.108:42124] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i
...
show less
Bad Web Bot
Web App Attack
🇭🇰
45.120.216.232
29 Oct 2026
2026-10-29T10:29:51.113919 main.justuptowngames.com sshd-session[2208759]: Invalid user valheim from ...
show more
2026-10-29T10:29:51.113919 main.justuptowngames.com sshd-session[2208759]: Invalid user valheim from 45.120.216.232 port 48698
2026-10-29T10:33:28.999421 main.justuptowngames.com sshd-session[2211785]: Invalid user teamspeak from 45.120.216.232 port 60904
2026-10-29T10:35:18.833360 main.justuptowngames.com sshd-session[2213230]: Invalid user admin from 45.120.216.232 port 35052
2026-10-29T10:36:54.700366 main.justuptowngames.com sshd-session[2214470]: Invalid user test from 45.120.216.232 port 37416
2026-10-29T10:38:32.227635 main.justuptowngames.com sshd-session[2216220]: Invalid user ahmed from 45.120.216.232 port 39774
...
show less
Brute-Force
SSH
🇳🇱
81.171.72.93
29 Oct 2026
[Thu Oct 29 10:38:20.949131 2026] [:error] [pid 1496:tid 1630] [client 81.171.72.93:35362] [client 8 ...
show more
[Thu Oct 29 10:38:20.949131 2026] [:error] [pid 1496:tid 1630] [client 81.171.72.93:35362] [client 81.171.72.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "main.justuptowngames.com"] [uri "/.env.production"] [unique_id "auNaXKaKk8Iu4gEWJw6jDAAAAFQ"]
[Thu Oct 29 10:38:21.068634 2026] [:error] [pid 1496:tid 1634] [client 81.171.72.93:35374] [client 81.171.72.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(
...
show less
Bad Web Bot
Web App Attack
🇸🇬
34.21.208.103
29 Oct 2026
[Thu Oct 29 10:26:22.075828 2026] [:error] [pid 1495:tid 1699] [client 34.21.208.103:56004] [client ...
show more
[Thu Oct 29 10:26:22.075828 2026] [:error] [pid 1495:tid 1699] [client 34.21.208.103:56004] [client 34.21.208.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "mail.iwle.com"] [uri "/.env"] [unique_id "auNXjm_nWaB4nWg2d8dzWAAAABI"]
[Thu Oct 29 10:26:22.967367 2026] [:error] [pid 3674:tid 3729] [client 34.21.208.103:56014] [client 34.21.208.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.
...
show less
Bad Web Bot
Web App Attack
🇺🇸
34.74.37.180
29 Oct 2026
[Thu Oct 29 10:25:32.704137 2026] [:error] [pid 3674:tid 3726] [client 34.74.37.180:0] [client 34.74 ...
show more
[Thu Oct 29 10:25:32.704137 2026] [:error] [pid 3674:tid 3726] [client 34.74.37.180:0] [client 34.74.37.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.justuptowngames.com"] [uri "/.gitconfig"] [unique_id "auNXXJ2jysUWRkKCatjhQgAAAM8"], referer: https://justuptowngames.com/.gitconfig
[Thu Oct 29 10:25:33.131193 2026] [:error] [pid 1495:tid 1665] [client 34.74.37.180:0] [client 34.74.37.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anoma
...
show less
Bad Web Bot
Web App Attack
🇧🇷
35.247.207.187
29 Oct 2026
[Thu Oct 29 09:47:27.683128 2026] [:error] [pid 3674:tid 3728] [client 35.247.207.187:0] [client 35. ...
show more
[Thu Oct 29 09:47:27.683128 2026] [:error] [pid 3674:tid 3728] [client 35.247.207.187:0] [client 35.247.207.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "dashboard.iwle.com"] [uri "/media../.env"] [unique_id "auNOb52jysUWRkKCatjgZgAAANE"]
[Thu Oct 29 09:47:27.683546 2026] [:error] [pid 3674:tid 3720] [client 35.247.207.187:0] [client 35.247.207.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.en
...
show less
Bad Web Bot
Web App Attack
🇳🇱
45.148.10.5
29 Oct 2026
[Thu Oct 29 08:31:20.992709 2026] [:error] [pid 3674:tid 3713] [client 45.148.10.5:25812] [client 45 ...
show more
[Thu Oct 29 08:31:20.992709 2026] [:error] [pid 3674:tid 3713] [client 45.148.10.5:25812] [client 45.148.10.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "63.141.255.191"] [uri "/.env.live"] [unique_id "auM8mJ2jysUWRkKCatjgCgAAAMQ"]
[Thu Oct 29 08:31:21.840957 2026] [:error] [pid 1432748:tid 1432782] [client 45.148.10.5:25848] [client 45.148.10.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\
...
show less
Bad Web Bot
Web App Attack
🇺🇸
209.38.69.12
29 Oct 2026
2026-10-29T06:48:17.210145 main.justuptowngames.com sshd-session[2027598]: Invalid user vpn from 209 ...
show more
2026-10-29T06:48:17.210145 main.justuptowngames.com sshd-session[2027598]: Invalid user vpn from 209.38.69.12 port 34310
2026-10-29T06:50:27.825062 main.justuptowngames.com sshd-session[2029355]: Invalid user bot from 209.38.69.12 port 55674
2026-10-29T06:51:54.116202 main.justuptowngames.com sshd-session[2030449]: Invalid user debian from 209.38.69.12 port 42440
2026-10-29T06:53:13.563198 main.justuptowngames.com sshd-session[2031679]: Invalid user debian from 209.38.69.12 port 57714
2026-10-29T06:54:48.251834 main.justuptowngames.com sshd-session[2032883]: Invalid user dev from 209.38.69.12 port 44720
...
show less
Brute-Force
SSH
🇨🇭
179.43.153.2
29 Oct 2026
2026-10-29T06:34:30.190436 main.justuptowngames.com sshd-session[2016259]: Invalid user dennis from ...
show more
2026-10-29T06:34:30.190436 main.justuptowngames.com sshd-session[2016259]: Invalid user dennis from 179.43.153.2 port 35140
...
show less
Brute-Force
SSH
🇮🇩
103.46.186.148
29 Oct 2026
[Thu Oct 29 05:52:56.312632 2026] [:error] [pid 3674:tid 3732] [client 103.46.186.148:44302] [client ...
show more
[Thu Oct 29 05:52:56.312632 2026] [:error] [pid 3674:tid 3732] [client 103.46.186.148:44302] [client 103.46.186.148] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 10 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "63.141.255.191"] [uri "/hello.world"] [unique_id "auMXeJ2jysUWRkKCatjfFgAAANU"]
[Thu Oct 29 05:52:56.544163 2026] [:error] [pid 3674:tid 3726] [client 103.46.186.148:44302] [client 103.46.186.148] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 10 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"]
...
show less
Bad Web Bot
Web App Attack
🇱🇹
77.90.185.129
29 Oct 2026
[Thu Oct 29 05:18:30.460357 2026] [:error] [pid 1432748:tid 1432797] [client 77.90.185.129:0] [clien ...
show more
[Thu Oct 29 05:18:30.460357 2026] [:error] [pid 1432748:tid 1432797] [client 77.90.185.129:0] [client 77.90.185.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "autodiscover.iwle.com"] [uri "/.vscode/sftp.json"] [unique_id "auMPZt-i_sYl-Np2v-0xhQAAARU"]
[Thu Oct 29 05:18:36.158462 2026] [:error] [pid 1497:tid 1655] [client 77.90.185.129:0] [client 77.90.185.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)
...
show less
Bad Web Bot
Web App Attack
🇺🇸
157.230.155.143
29 Oct 2026
[Thu Oct 29 04:36:12.618636 2026] [:error] [pid 3674:tid 3720] [client 157.230.155.143:0] [client 15 ...
show more
[Thu Oct 29 04:36:12.618636 2026] [:error] [pid 3674:tid 3720] [client 157.230.155.143:0] [client 157.230.155.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)^/(?:wp-admin(?:/|$)|wp-content(?:/|$)|wp-includes(?:/|$)|wp-login\\\\.php$|wp-editor\\\\.php$|wp-mail\\\\.php$|xmlrpc\\\\.php$)" at REQUEST_URI. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "152"] [id "100114"] [msg "Local Policy: WordPress probe on non-WordPress site"] [severity "WARNING"] [tag "local/wordpress-probe"] [hostname "iwle.com"] [uri "/wp-login.php"] [unique_id "auMFfJ2jysUWRkKCatjeeAAAAMk"]
[Thu Oct 29 04:36:15.881451 2026] [:error] [pid 1497:tid 1680] [client 157.230.155.143:50855] [client 157.230.155.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)^/(?:wp-admin(?:/|$)|wp-content(?:/|$)|wp-includes(?:/|$)|wp-login\\\\.php$|wp-editor\\\\.php$|wp-mail\\\\.php$|xmlrpc\\\\.php$)" at REQUEST_URI. [file "/etc/httpd/modsecurity.d/local_rul
...
show less
Bad Web Bot
Web App Attack
🇷🇴
2.57.122.238
29 Oct 2026
2026-10-29T04:17:43.357081 main.justuptowngames.com sshd-session[1904018]: Invalid user sol from 2.5 ...
show more
2026-10-29T04:17:43.357081 main.justuptowngames.com sshd-session[1904018]: Invalid user sol from 2.57.122.238 port 51906
...
show less
Brute-Force
SSH
🇨🇳
115.191.36.93
29 Oct 2026
2026-10-29T03:51:23.729404 main.justuptowngames.com proftpd[1882554]: session[1882554] 0.0.0.0 (115. ...
show more
2026-10-29T03:51:23.729404 main.justuptowngames.com proftpd[1882554]: session[1882554] 0.0.0.0 (115.191.36.93[115.191.36.93]): USER root (Login failed): Incorrect password
2026-10-29T03:51:25.346905 main.justuptowngames.com proftpd[1882580]: session[1882580] 0.0.0.0 (115.191.36.93[115.191.36.93]): USER root (Login failed): Incorrect password
2026-10-29T03:51:27.065469 main.justuptowngames.com proftpd[1882589]: session[1882589] 0.0.0.0 (115.191.36.93[115.191.36.93]): USER root (Login failed): Incorrect password
2026-10-29T03:51:28.749272 main.justuptowngames.com proftpd[1882616]: session[1882616] 0.0.0.0 (115.191.36.93[115.191.36.93]): USER root (Login failed): Incorrect password
2026-10-29T03:51:30.397116 main.justuptowngames.com proftpd[1882644]: session[1882644] 0.0.0.0 (115.191.36.93[115.191.36.93]): USER root (Login failed): Incorrect password
...
show less
Brute-Force
FTP Brute-Force
🇺🇸
162.35.10.91
29 Oct 2026
2026-10-29T03:43:22.431508 main.justuptowngames.com proftpd[1875941]: session[1875941] 0.0.0.0 (162. ...
show more
2026-10-29T03:43:22.431508 main.justuptowngames.com proftpd[1875941]: session[1875941] 0.0.0.0 (162.35.10.91[162.35.10.91]): USER root (Login failed): Incorrect password
2026-10-29T03:43:23.295928 main.justuptowngames.com proftpd[1875963]: session[1875963] 0.0.0.0 (162.35.10.91[162.35.10.91]): USER root (Login failed): Incorrect password
2026-10-29T03:43:24.167414 main.justuptowngames.com proftpd[1875967]: session[1875967] 0.0.0.0 (162.35.10.91[162.35.10.91]): USER root (Login failed): Incorrect password
2026-10-29T03:43:25.000763 main.justuptowngames.com proftpd[1875993]: session[1875993] 0.0.0.0 (162.35.10.91[162.35.10.91]): USER root (Login failed): Incorrect password
2026-10-29T03:43:25.817413 main.justuptowngames.com proftpd[1875996]: session[1875996] 0.0.0.0 (162.35.10.91[162.35.10.91]): USER root (Login failed): Incorrect password
...
show less
Brute-Force
FTP Brute-Force