🇺🇸
nathan-m
2025-09-05 12:22:00
(10 months ago)
Attempting to access sensitive server files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-09-04 22:55:47
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 04 18:55:42.917446 2025] [security2:error] [pid 2620:tid 2620] [client 109.120.137.79:64006] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.albertawaterjet.com"] [uri "/.ENV.zip"] [unique_id "aLoY7r5lRUxz16mfpkadKgAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-04 20:49:05
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 04 16:49:01.581821 2025] [security2:error] [pid 6456:tid 6456] [client 109.120.137.79:64643] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kiddocommunication.com"] [uri "/.ENV.zip"] [unique_id "aLn7PSfyzateklz2742OTAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2025-09-04 20:16:05
(10 months ago)
{"level":"info","ts":1757016958.784939,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1757016958.784939,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"109.120.137.79","remote_port":"55331","client_ip":"109.120.137.79","proto":"HTTP/1.1","method":"GET","host":"status.cloudpos.me","uri":"/status.zip","headers":{"User-Agent":["Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0"],"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection":["keep-alive"]}},"bytes_read":0,"user_id":"","duration":0.00005132,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.cloudpos.me/status.zip"],"Content-Type":[]}}
{"level":"info","ts":1757016958.829523,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"109.120.137.79","remote_port":"55379","client_ip":"109.120.137.79","proto":"HTTP/1.1","method":"GET","host":"status.cloudpos.me","uri":"/status.zip","headers":{"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2025-09-04 19:59:47
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 04 15:59:41.826836 2025] [security2:error] [pid 1896670:tid 1896700] [client 109.120.137.79:58780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "saludmyg.com.neotienda.com"] [uri "/.ENV.zip"] [unique_id "aLnvrWjGr5UuWpEY2pElPQAAARU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-04 18:54:10
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 109.120.137.79 (s161489.love-is.nexus): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 04 14:54:05.434869 2025] [security2:error] [pid 29682:tid 29682] [client 109.120.137.79:60022] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.idabwellsmonument.org"] [uri "/.ENV.zip"] [unique_id "aLngTX2hObqz7nKPV9InCwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
KPS
2025-04-28 16:44:37
(1 year ago)
PortscanN
Port Scan
🇳🇱
Study Bitcoin 🤗
2025-04-03 18:56:51
(1 year ago)
2 port probes: tcp/4781, tcp/42568
[srv133]
Port Scan