2026-09-22 16:34:43
(1 month ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
2026-09-17 19:42:13
(1 month ago)
"GET /.git/HEAD HTTP/1.1"
Hacking
Web App Attack
🇨🇦
Anytech
2026-09-17 18:47:12
(1 month ago)
Blocked by ConnMonitor
Web App Attack
🇩🇪
4server
2026-09-17 18:45:46
(1 month ago)
[ThuSep1720:45:41.0037982026][security2:error][pid2546092:tid2546315][client144.172.107.23:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949- ...
show more
[ThuSep1720:45:41.0037982026][security2:error][pid2546092:tid2546315][client144.172.107.23:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"simireinigung.ch\"][uri\"/.git/HEAD\"][unique_id\"aqw1VDnWx8ukYlwKozij3AAAARM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇷🇺
Mga Admin
2026-09-17 18:18:22
(1 month ago)
144.172.107.23 - - [18/Sep/2026:01:18:20 +0700] "GET /.git/HEAD HTTP/1.1" 404 69 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
Web App Attack
🇧🇪
boxed-it
2026-09-17 18:06:40
(1 month ago)
GET /.git/HEAD (Tarpitted for 2m10s, wasted 7.73kB)
Web App Attack
🇩🇪
FeG Deutschland
2026-09-17 15:38:44
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇳🇱
Alt255
2026-09-17 14:52:52
(1 month ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 144.172.107.23 - - [17/Sep/2026:16:52:39 +0200] "GET /.git/HEAD HTTP/1.1" 301 6488 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 ...
show more
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 144.172.107.23 - - [17/Sep/2026:16:52:39 +0200] "GET /.git/HEAD HTTP/1.1" 301 6488 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ut-addicted.com
2026-09-17 13:46:48
(1 month ago)
\[Thu Sep 17 15:46:47.514341 2026\] \[:error\] \[pid 32606:tid 140352556078848\] \[client 144.172.107.23:58066\] \[client 144.172.107.23\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/l ...
show more
\[Thu Sep 17 15:46:47.514341 2026\] \[:error\] \[pid 32606:tid 140352556078848\] \[client 144.172.107.23:58066\] \[client 144.172.107.23\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "crx.it"\] \[uri "/.git/HEAD"\] \[unique_id "aqvvR2XDlcTBJB-GjRr5AQAAAMc"\]
show less
Brute-Force
Web App Attack
🇳🇱
BlueWire Hosting
2026-09-17 13:43:55
(1 month ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
kosada.com
2026-09-17 13:28:40
(1 month ago)
Repeated requests for suspicious nonexistent URLs, for example: /.git/HEAD (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-17 13:11:20
(1 month ago)
[17/Sep/2026:16:11:19 +0300] -- 144.172.107.23 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/HEAD HTTP/1.1
Bad Web Bot
Web App Attack
🇦🇺
Bay13
2026-09-17 10:33:35
(1 month ago)
CrowdSec:custom/http-sensitive-files
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 09:56:58
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 2002:90ac:6b17::90ac:6b17 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:56:55.747452 2026] [security2:error] [pid 18541:tid 18541] [client 2002 ...
show more
(mod_security) mod_security (id:210492) triggered by 2002:90ac:6b17::90ac:6b17 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:56:55.747452 2026] [security2:error] [pid 18541:tid 18541] [client 2002:90ac:6b17::90ac:6b17:54837] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arrowhead30.com"] [uri "/.git/HEAD"] [unique_id "aqu5Z_cgsegjxdl6Ue7VVwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 09:33:17
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 2002:90ac:6b17::90ac:6b17 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:33:12.373514 2026] [security2:error] [pid 15426:tid 15426] [client 2002 ...
show more
(mod_security) mod_security (id:210492) triggered by 2002:90ac:6b17::90ac:6b17 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:33:12.373514 2026] [security2:error] [pid 15426:tid 15426] [client 2002:90ac:6b17::90ac:6b17:59295] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rookscpa.com"] [uri "/.git/HEAD"] [unique_id "aquz2JFm7g5Eqr6OOmilHQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
