|
Anonymous
|
|
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
|
Exploited Host
|
|
Anonymous
|
|
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web server; honeypot hit, banned on first attempt.
|
Web App Attack
Bad Web Bot
|
|
Anonymous
|
|
GET /.git/HEAD HTTP/1.1
...
|
Web App Attack
|
|
🇩🇪
FeG Deutschland
|
|
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127
|
Exploited Host
Web App Attack
|
|
Anonymous
|
|
Fuzzing/Looking for credentials files.
|
Brute-Force
Web App Attack
|
|
🇹🇷
oalver
|
|
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature. Sources: nginx. Details: path_signature: request to /.git/HEAD (HTTP 403); path_signature: request to /.git/HEAD (HTTP 404). First seen: 2026-09 ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature. Sources: nginx. Details: path_signature: request to /.git/HEAD (HTTP 403); path_signature: request to /.git/HEAD (HTTP 404). First seen: 2026-09-17. Risk score: 60/100.
show less
|
Web App Attack
|
|
🇺🇸
Alvino
|
|
Blocked due to using a VPN or data center IP with abuse: 100
|
Web Spam
VPN IP
|
|
🇬🇧
thetomtaylor.co.uk
|
|
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice01,ice02,wa01,wa02]
|
Bad Web Bot
Web App Attack
|
|
🇳🇱
Alt255
|
|
[cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 144.172.107.246 - - [17/Sep/2026:11:42:50 +0200] "GET /.git/HEAD HTTP/1.1" 404 1350 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 ...
show more
[cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 144.172.107.246 - - [17/Sep/2026:11:42:50 +0200] "GET /.git/HEAD HTTP/1.1" 404 1350 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇳🇱
MyGlobalFlowers
|
|
Multiple WAF Violations
|
Web App Attack
|
|
🇦🇺
paulshipley.com.au
|
|
[Thu Sep 17 19:33:01.301527 2026] [security2:error] [pid 502672] [client 144.172.107.246:54504] [client 144.172.107.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/ ...
show more
[Thu Sep 17 19:33:01.301527 2026] [security2:error] [pid 502672] [client 144.172.107.246:54504] [client 144.172.107.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stkildashule.org.au"] [uri "/.git/HEAD"] [unique_id "aquzzVOJBxYDUZHX1G5ppgAAAAU"]
...
show less
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 2002:90ac:6bf6::90ac:6bf6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:29:20.940565 2026] [security2:error] [pid 12497:tid 12497] [client 2002 ...
show more
(mod_security) mod_security (id:210492) triggered by 2002:90ac:6bf6::90ac:6bf6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:29:20.940565 2026] [security2:error] [pid 12497:tid 12497] [client 2002:90ac:6bf6::90ac:6bf6:63812] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "innolympics.com"] [uri "/.git/HEAD"] [unique_id "aquy8Caz3Zfl0FaP62Y44AAAABc"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇷
Baking333
|
|
[redacted] 144.172.107.246 - - [17/Sep/2026:08:27:34 +0100] "GET /.git/HEAD HTTP/1.1" 302 6773 0/52569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 [redacted] 144.172.107.24 ...
show more
[redacted] 144.172.107.246 - - [17/Sep/2026:08:27:34 +0100] "GET /.git/HEAD HTTP/1.1" 302 6773 0/52569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 [redacted] 144.172.107.246 - - [17/Sep/2026:08:27:35 +0100] "GET / HTTP/1.1" 200 12435 0/83951 "https://[redacted]/.git/HEAD" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443
show less
|
Bad Web Bot
Web App Attack
|
|
🇮🇳
evicky2002
|
|
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
|
Hacking
Brute-Force
SSH
|
|
🇬🇧
seniorlinuxadmin
|
|
144.172.107.246 - - [17/Sep/2026:06:31:06 +0100] "GET /.git/HEAD HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
|
Port Scan
Web App Attack
|
