AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User aaKenshin joined AbuseIPDB in April 2025 and has reported 20,927 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇳🇱 45.148.10.21	04 Nov 2026	Suspicious activity detected from IP 45.148.10.21 based on web server logs. Sample logs: [akurasirs ... show more Suspicious activity detected from IP 45.148.10.21 based on web server logs. Sample logs: [akurasirsudainun.] 45.148.10.21 - - [04/Nov/2026:14:10:50 +0800] "GET /Dockerfile HTTP/2.0" 307 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" [akurasirsudainun.] 45.148.10.21 - - [04/Nov/2026:14:10:50 +0800] "GET /_profiler/phpinfo HTTP/2.0" 307 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" [akurasirsudainun.] 45.148.10.21 - - [04/Nov/2026:14:10:50 +0800] "GET /actuator/env HTTP/2.0" 307 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇫🇷 104.28.158.11	04 Nov 2026	Brute-force mail login (SMTP AUTH): 16 failed login attempts, 2026-11-04 12:49 to 12:49 UTC+8. Sampl ... show more Brute-force mail login (SMTP AUTH): 16 failed login attempts, 2026-11-04 12:49 to 12:49 UTC+8. Sample log (sensitive data redacted): 2026-11-04 12:49:36 [name=[redacted];oip=104.28.158.11;oport=58748;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04 12:49:36 [name=[redacted];oip=104.28.158.11;oport=60084;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04 12:49:37 [name=[redacted];oip=104.28.158.11;oport=60081;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04T12:49:36 mail postfix/submission/smtpd[1800473]: warning: unknown[104.28.158.11]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] show less	Brute-Force
🇫🇷 169.40.142.138	04 Nov 2026	Suspicious activity detected from IP 169.40.142.138 based on web server logs. Sample logs: [bappeda ... show more Suspicious activity detected from IP 169.40.142.138 based on web server logs. Sample logs: [bappeda-] 169.40.142.138 - - [04/Nov/2026:12:30:45 +0800] "GET /.git/HEAD HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" [bappeda-] 169.40.142.138 - - [04/Nov/2026:12:30:45 +0800] "GET /.git/config HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" [bappeda-] 169.40.142.138 - - [04/Nov/2026:12:30:45 +0800] "GET /.git/index HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇧🇷 179.238.29.245	04 Nov 2026	Brute-force mail login (SMTP AUTH): 3 failed login attempts against 2 different accounts, 2026-11-04 ... show more Brute-force mail login (SMTP AUTH): 3 failed login attempts against 2 different accounts, 2026-11-04 10:19 to 12:22 UTC+8. Sample log (sensitive data redacted): 2026-11-04 12:22:59 [name=[redacted];oip=179.238.29.245;oport=37154;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invali 2026-11-04T10:19:19 mail postfix/smtps/smtpd[1714054]: warning: unknown[179.238.29.245]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] 2026-11-04T12:22:59 mail postfix/smtps/smtpd[1787110]: warning: unknown[179.238.29.245]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] show less	Brute-Force
🇨🇳 36.132.129.21	04 Nov 2026	Brute-force mail login (SMTP AUTH): 5 failed login attempts against 3 different accounts, 2026-11-04 ... show more Brute-force mail login (SMTP AUTH): 5 failed login attempts against 3 different accounts, 2026-11-04 06:02 to 12:23 UTC+8. Sample log (sensitive data redacted): 2026-11-04 06:02:01 [name=[redacted];oip=36.132.129.21;oport=5441;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04 12:23:24 [name=[redacted];oip=36.132.129.21;oport=21847;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04T07:16:45 mail postfix/smtps/smtpd[1612473]: warning: unknown[36.132.129.21]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] 2026-11-04T12:23:24 mail postfix/smtps/smtpd[1780237]: warning: unknown[36.132.129.21]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] show less	Brute-Force
🇨🇳 113.140.95.2	04 Nov 2026	Brute-force mail login (SMTP AUTH): 11 failed login attempts against 6 different accounts, 2026-11-0 ... show more Brute-force mail login (SMTP AUTH): 11 failed login attempts against 6 different accounts, 2026-11-04 03:25 to 12:09 UTC+8. Sample log (sensitive data redacted): 2026-11-04 06:40:41 [name=[redacted];oip=113.140.95.2;oport=43683;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04 10:05:34 [name=[redacted];oip=113.140.95.2;oport=39684;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04 12:09:39 [name=[redacted];oip=113.140.95.2;oport=60997;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid show less	Brute-Force
🇧🇷 187.50.226.182	04 Nov 2026	Brute-force mail login (IMAP/SMTP AUTH): 21 failed login attempts against 15 different accounts, 202 ... show more Brute-force mail login (IMAP/SMTP AUTH): 21 failed login attempts against 15 different accounts, 2026-11-04 03:26 to 11:51 UTC+8. Sample log (sensitive data redacted): 2026-11-04 10:11:25 [name=[redacted];oip=187.50.226.182;oport=40312;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invali 2026-11-04 11:03:52 [name=[redacted];oip=187.50.226.182;oport=54528;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invali 2026-11-04 11:51:55 [name=[redacted];oip=187.50.226.182;oport=36563;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invali show less	Brute-Force
🇮🇩 180.249.193.234	04 Nov 2026	Suspicious activity detected from IP 180.249.193.234 based on web server logs. Sample logs: [geopar ... show more Suspicious activity detected from IP 180.249.193.234 based on web server logs. Sample logs: [geopark-] 180.249.193.234 - - [04/Nov/2026:09:45:16 +0800] "GET /about.php HTTP/1.1" 404 118 "-" "python-httpx/0.28.1" [geopark-] 180.249.193.234 - - [04/Nov/2026:09:45:17 +0800] "GET /wp-admin/css/colors/blue/chosen.php HTTP/1.1" 404 118 "-" "python-httpx/0.28.1" [geopark-] 180.249.193.234 - - [04/Nov/2026:09:45:19 +0800] "GET /defaults.php HTTP/1.1" 404 118 "-" "python-httpx/0.28.1" Reported automatically by fail2ban service. show less	Hacking
🇩🇪 23.132.164.17	04 Nov 2026	Suspicious activity detected from IP 23.132.164.17 based on web server logs. Sample logs: [] 23.132 ... show more Suspicious activity detected from IP 23.132.164.17 based on web server logs. Sample logs: [] 23.132.164.17 - - [04/Nov/2026:10:33:14 +0800] "GET /test.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [grhm-] 23.132.164.17 - - [04/Nov/2026:10:33:14 +0800] "GET /Gemfile.lock HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [grhm-] 23.132.164.17 - - [04/Nov/2026:10:33:14 +0800] "GET /Thumbs.db HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇿🇦 20.164.210.40	04 Nov 2026	Suspicious activity detected from IP 20.164.210.40 based on web server logs. Sample logs: [] 20.164 ... show more Suspicious activity detected from IP 20.164.210.40 based on web server logs. Sample logs: [] 20.164.210.40 - - [04/Nov/2026:09:04:48 +0800] "GET /wp-includes/block-supports/custom-classname-merge.php HTTP/1.1" 301 162 "-" "-" [bappeda-] 20.164.210.40 - - [04/Nov/2026:09:04:48 +0800] "GET /wp-sing.php HTTP/1.1" 404 10260 "-" "-" [bappeda-] 20.164.210.40 - - [04/Nov/2026:09:04:49 +0800] "GET /wp-includes/block-supports/custom-classname-merge.php HTTP/1.1" 404 10302 "-" "-" Reported automatically by fail2ban service. show less	Web App Attack
🇦🇪 20.74.238.220	03 Nov 2026	Suspicious activity detected from IP 20.74.238.220 based on web server logs. Sample logs: [] 20.74. ... show more Suspicious activity detected from IP 20.74.238.220 based on web server logs. Sample logs: [] 20.74.238.220 - - [04/Nov/2026:07:07:56 +0800] "GET /sc.php HTTP/1.1" 301 162 "-" "-" [siapgo-] 20.74.238.220 - - [04/Nov/2026:07:07:56 +0800] "GET /ans.php HTTP/1.1" 404 0 "-" "-" [siapgo-] 20.74.238.220 - - [04/Nov/2026:07:07:56 +0800] "GET /sc.php HTTP/1.1" 404 0 "-" "-" Reported automatically by fail2ban service. show less	Web App Attack
🇳🇱 34.7.27.164	03 Nov 2026	Suspicious activity detected from IP 34.7.27.164 based on web server logs. Sample logs: [sifandirsu ... show more Suspicious activity detected from IP 34.7.27.164 based on web server logs. Sample logs: [sifandirsudainun.] 34.7.27.164 - - [04/Nov/2026:07:19:49 +0800] "GET /.env.bak HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" [sifandirsudainun.] 34.7.27.164 - - [04/Nov/2026:07:19:49 +0800] "GET /.env.remote HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" [sifandirsudainun.] 34.7.27.164 - - [04/Nov/2026:07:19:49 +0800] "GET /.env.save HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇺🇸 192.236.217.91	03 Nov 2026	Suspicious activity detected from IP 192.236.217.91 based on web server logs. Sample logs: [geopark ... show more Suspicious activity detected from IP 192.236.217.91 based on web server logs. Sample logs: [geopark-] 192.236.217.91 - - [04/Nov/2026:00:52:46 +0800] "" 400 0 "-" "-" [geopark-] 192.236.217.91 - - [04/Nov/2026:06:44:52 +0800] "GET /wp-content/themes/travelscape/json.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" [geopark-] 192.236.217.91 - - [04/Nov/2026:06:44:54 +0800] "GET /wp-content/themes/aahana/json.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" Reported automatically by fail2ban service. show less	Hacking
🇸🇬 194.5.82.41	03 Nov 2026	Suspicious activity detected from IP 194.5.82.41 based on web server logs. Sample logs: [sso.] 194. ... show more Suspicious activity detected from IP 194.5.82.41 based on web server logs. Sample logs: [sso.] 194.5.82.41 - - [04/Nov/2026:06:05:16 +0800] "POST /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sso.] 194.5.82.41 - - [04/Nov/2026:06:05:16 +0800] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:122.0) Gecko/20100101 Firefox/122.0" [sso.] 194.5.82.41 - - [04/Nov/2026:06:05:16 +0800] "POST /vendor/phpunits/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇸🇬 194.5.82.40	03 Nov 2026	Suspicious activity detected from IP 194.5.82.40 based on web server logs. Sample logs: [sso.] 194. ... show more Suspicious activity detected from IP 194.5.82.40 based on web server logs. Sample logs: [sso.] 194.5.82.40 - - [04/Nov/2026:06:05:09 +0800] "GET /api/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sso.] 194.5.82.40 - - [04/Nov/2026:06:05:09 +0800] "GET /backend/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sso.] 194.5.82.40 - - [04/Nov/2026:06:05:09 +0800] "GET /laravel/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇮🇳 203.129.225.146	03 Nov 2026	Brute-force mail login (SMTP AUTH): 23 failed login attempts against 18 different accounts, 2026-11- ... show more Brute-force mail login (SMTP AUTH): 23 failed login attempts against 18 different accounts, 2026-11-03 10:06 to 2026-11-04 04:31 UTC+8. Sample log (sensitive data redacted): 2026-11-04 03:46:40 [name=[redacted];oip=203.129.225.146;oport=61357;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: inval 2026-11-04 04:31:10 [name=[redacted];oip=203.129.225.146;oport=54480;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: inval 2026-11-04T03:46:40 mail postfix/smtps/smtpd[1528686]: warning: unknown[203.129.225.146]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] 2026-11-04T04:31:10 mail postfix/smtps/smtpd[1549097]: warning: unknown[203.129.225.146]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] show less	Brute-Force
🇷🇺 46.44.38.109	03 Nov 2026	Brute-force mail login (SMTP AUTH): 15 failed login attempts against 12 different accounts, 2026-11- ... show more Brute-force mail login (SMTP AUTH): 15 failed login attempts against 12 different accounts, 2026-11-03 04:27 to 2026-11-04 04:30 UTC+8. Sample log (sensitive data redacted): 2026-11-04 03:46:23 [name=[redacted];oip=46.44.38.109;oport=50756;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04 04:30:39 [name=[redacted];oip=46.44.38.109;oport=39476;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid 2026-11-04T03:46:37 mail postfix/smtps/smtpd[1528596]: warning: unknown[46.44.38.109]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] 2026-11-04T04:30:39 mail postfix/smtps/smtpd[1549144]: warning: unknown[46.44.38.109]: SASL LOGIN authentication failed: authentication failure, sasl_username=[redacted] show less	Brute-Force
🇮🇩 114.122.15.200	03 Nov 2026	Suspicious activity detected from IP 114.122.15.200 based on web server logs. Sample logs: [uptdtpa ... show more Suspicious activity detected from IP 114.122.15.200 based on web server logs. Sample logs: [uptdtpat-] 114.122.15.200 - - [04/Nov/2026:04:09:31 +0800] "GET /bpk.php HTTP/1.1" 404 1659 "-" "python-httpx/0.28.1" [uptdtpat-] 114.122.15.200 - - [04/Nov/2026:04:09:32 +0800] "GET /assets/css/Run.php HTTP/1.1" 404 1668 "-" "python-httpx/0.28.1" [uptdtpat-] 114.122.15.200 - - [04/Nov/2026:04:09:36 +0800] "GET /cord.php HTTP/1.1" 404 1661 "-" "python-httpx/0.28.1" Reported automatically by fail2ban service. show less	Hacking
🇫🇷 185.177.72.75	03 Nov 2026	Suspicious activity detected from IP 185.177.72.75 based on web server logs. Sample logs: [belakan. ... show more Suspicious activity detected from IP 185.177.72.75 based on web server logs. Sample logs: [belakan.] 185.177.72.75 - - [04/Nov/2026:04:24:28 +0800] "GET /local-config%252ephp HTTP/1.1" 404 2311 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" [belakan.] 185.177.72.75 - - [04/Nov/2026:04:24:28 +0800] "GET /parameters%252eyml HTTP/1.1" 404 2311 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" [belakan.] 185.177.72.75 - - [04/Nov/2026:04:24:36 +0800] "GET /server%252ephp HTTP/1.1" 404 2311 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇸🇬 194.5.82.19	03 Nov 2026	Suspicious activity detected from IP 194.5.82.19 based on web server logs. Sample logs: [sippedas.] ... show more Suspicious activity detected from IP 194.5.82.19 based on web server logs. Sample logs: [sippedas.] 194.5.82.19 - - [04/Nov/2026:01:52:12 +0800] "GET /config/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sippedas.] 194.5.82.19 - - [04/Nov/2026:01:52:12 +0800] "GET /src/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sippedas.] 194.5.82.19 - - [04/Nov/2026:01:52:12 +0800] "GET /web/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇸🇬 194.5.82.25	03 Nov 2026	Suspicious activity detected from IP 194.5.82.25 based on web server logs. Sample logs: [sippedas.] ... show more Suspicious activity detected from IP 194.5.82.25 based on web server logs. Sample logs: [sippedas.] 194.5.82.25 - - [04/Nov/2026:01:52:06 +0800] "GET /.env.production HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sippedas.] 194.5.82.25 - - [04/Nov/2026:01:52:06 +0800] "GET /.env.staging HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [sippedas.] 194.5.82.25 - - [04/Nov/2026:01:52:06 +0800] "GET /.env.txt HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇮🇳 137.23.38.53	03 Nov 2026	Suspicious activity detected from IP 137.23.38.53 based on web server logs. Sample logs: [] 137.23. ... show more Suspicious activity detected from IP 137.23.38.53 based on web server logs. Sample logs: [] 137.23.38.53 - - [03/Nov/2026:23:55:20 +0800] "GET /.env.production.local HTTP/1.1" 404 146 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" [] 137.23.38.53 - - [03/Nov/2026:23:55:20 +0800] "GET /.env.production.local HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" [] 137.23.38.53 - - [03/Nov/2026:23:55:20 +0800] "GET /.env.staging HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" Reported automatically by fail2ban service. show less	Web App Attack
🇸🇬 64.49.8.65	03 Nov 2026	Brute-force mail login (SMTP AUTH): 17 failed login attempts against 3 different accounts, 2026-11-0 ... show more Brute-force mail login (SMTP AUTH): 17 failed login attempts against 3 different accounts, 2026-11-03 10:09 to 22:32 UTC+8. Sample log (sensitive data redacted): 2026-11-03 19:53:51 [name=[redacted];oip=64.49.8.65;oport=59290;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid cr 2026-11-03 19:53:51 [name=[redacted];oip=64.49.8.65;oport=59290;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid cr 2026-11-03 22:31:38 [name=[redacted];oip=64.49.8.65;oport=63869;oproto=smtp] security - cmd=Auth; account=[redacted]; protocol=soap; error=authentication failed for [redacted], LDAP error: - unable to ldap authenticate: invalid cr show less	Brute-Force
🇩🇪 94.26.106.122	03 Nov 2026	Suspicious activity detected from IP 94.26.106.122 based on web server logs. Sample logs: [museum-] ... show more Suspicious activity detected from IP 94.26.106.122 based on web server logs. Sample logs: [museum-] 94.26.106.122 - - [03/Nov/2026:20:11:18 +0800] "POST /batu-mineral-kuarsa/wp-json/batch/v1 HTTP/1.1" 404 9736 "-" "Mozilla/5.0 (compatible)" [museum-] 94.26.106.122 - - [03/Nov/2026:20:11:20 +0800] "POST /batu-mineral-kuarsa/?[REDACTED] HTTP/1.1" 404 9719 "-" "Mozilla/5.0 (compatible)" Reported automatically by fail2ban service. show less	Web App Attack
🇩🇪 20.218.73.251	03 Nov 2026	Suspicious activity detected from IP 20.218.73.251 based on web server logs. Sample logs: [bkd-] 20 ... show more Suspicious activity detected from IP 20.218.73.251 based on web server logs. Sample logs: [bkd-] 20.218.73.251 - - [03/Nov/2026:19:44:55 +0800] "GET /lo.php HTTP/1.1" 404 146 "-" "-" [bkd-] 20.218.73.251 - - [03/Nov/2026:19:44:55 +0800] "GET /trial.php HTTP/1.1" 404 146 "-" "-" [bkd-] 20.218.73.251 - - [03/Nov/2026:19:44:56 +0800] "GET /wp-sing.php HTTP/1.1" 404 146 "-" "-" Reported automatically by fail2ban service. show less	Web App Attack