IP Address: 108.186.84.69

SSH (TCP/22): 16 login attempts, 3 distinct usernames, 2 distinct passwords | Automated web attack: 352 reqs, 45 paths probed, 268 returned 404; signals: stolen-credential-use; probed: 28 .env, 14 .php, 1 .git, 1 admin, 1 other

SSH (TCP/22): 16 login attempts, 3 distinct usernames, 2 distinct passwords | Automated web attack: 136 reqs, 19 paths probed, 52 returned 404; signals: stolen-credential-use; probed: 15 .php, 2 .env, 1 .git, 1 admin

Automated web attack: 8 reqs, 2 paths probed, 2 returned 404; signals: stolen-credential-use; probed: 1 .env, 1 .php

SSH (TCP/22): 8 login attempts, 1 distinct username, 1 distinct password | Automated web attack: 164 reqs, 37 paths probed, 108 returned 404; signals: stolen-credential-use; probed: 21 .env, 14 .php, 1 .git, 1 other

SSH (TCP/22): 26 login attempts, 3 distinct usernames, 2 distinct passwords | Automated web attack: 176 reqs, 39 paths probed, 118 returned 404; signals: stolen-credential-use; probed: 21 .env, 15 .php, 1 .git, 1 admin, 1 other

SSH (TCP/22): 16 login attempts, 3 distinct usernames, 2 distinct passwords | Automated web attack: 304 reqs, 40 paths probed, 220 returned 404; signals: stolen-credential-use; probed: 22 .env, 15 .php, 1 .git, 1 admin, 1 other

SSH (TCP/22): 20 login attempts, 3 distinct usernames, 2 distinct passwords | Automated web attack: 380 reqs, 48 paths probed, 288 returned 404; signals: stolen-credential-use; probed: 30 .env, 15 .php, 1 .git, 1 admin, 1 other

SSH (TCP/22): 6 login attempts, 1 distinct username, 1 distinct password | Automated web attack: 147 reqs, 36 paths probed, 102 returned 404; signals: stolen-credential-use; probed: 20 .env, 14 .php, 1 .git, 1 other

SSH (TCP/22): 9 login attempts, 3 distinct usernames, 2 distinct passwords | Automated web attack: 15 reqs, 4 paths probed, 6 returned 404; signals: stolen-credential-use; probed: 2 .php, 1 .env, 1 admin