🇳🇱
VMHeaven.io
2026-08-28 15:41:27
(15 hours ago)
Blocked by UFW [2096/tcp]
Source port: 14666
TTL: 41
Packet length: 60
Port Scan
🇺🇸
tedmichalik.com
2026-08-28 15:29:10
(15 hours ago)
135.232.177.248 - - [28/Aug/2026:11:28:53 -0400] "GET /.git/HEAD HTTP/1.1" 404 42031 "-" "Mozilla/5. ...
show more
135.232.177.248 - - [28/Aug/2026:11:28:53 -0400] "GET /.git/HEAD HTTP/1.1" 404 42031 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0"
...
show less
Web App Attack
🇯🇵
SentinalX by uzumaru
2026-08-16 02:12:55
(1 week ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: s.clipsexviett.blog:443:443
show less
Open Proxy
Port Scan
🇫🇷
service Informatique
2026-08-11 04:00:37
(2 weeks ago)
GET /wp-config
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 09:25:16
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 135.232.177.248 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.177.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 05:25:11.005746 2026] [security2:error] [pid 2210781:tid 2210781] [client 135.232.177.248:3663] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.143"] [uri "/.git/HEAD"] [unique_id "anmY9835v-LYgcNWzyV12QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 09:09:46
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 135.232.177.248 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.177.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 05:09:42.219835 2026] [security2:error] [pid 1722525:tid 1722525] [client 135.232.177.248:3669] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.55"] [uri "/.git/refs/heads/master"] [unique_id "anmVVoU28vKzNKUO0-A8mAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-08-10 08:03:22
(2 weeks ago)
Web vulnerability probing: /.env.production (bogus vhost/SNI)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 08:02:12
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 135.232.177.248 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.177.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 04:02:07.918313 2026] [security2:error] [pid 102483:tid 102483] [client 135.232.177.248:3660] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.150"] [uri "/.git/HEAD"] [unique_id "anmFf6gbIA4tkWkAEV_JFQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-10 07:57:53
(2 weeks ago)
Port Scan
Port Scan
🇷🇸
Scan
2026-08-10 07:41:21
(2 weeks ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
🇮🇩
sockominfo
2026-08-10 07:00:53
(2 weeks ago)
Access to sensitive configuration files detected.. Threat Score: 5/10 (MEDIUM). Confidence: 40%. CVS ...
show more
Access to sensitive configuration files detected.. Threat Score: 5/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇺🇸
zcampbell
2026-08-10 06:35:43
(2 weeks ago)
Web vulnerability scanning: probing for exposed sensitive files (.git). Detected and blocked automat ...
show more
Web vulnerability scanning: probing for exposed sensitive files (.git). Detected and blocked automatically.
show less
Web App Attack
Bad Web Bot
🇮🇩
sockominfo
2026-08-10 06:00:53
(2 weeks ago)
Access to sensitive configuration files detected.. Threat Score: 5.2/10 (MEDIUM). Confidence: 40%. C ...
show more
Access to sensitive configuration files detected.. Threat Score: 5.2/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-08-10 05:00:09
(2 weeks ago)
Access to sensitive configuration files detected.. Threat Score: 7.2/10 (HIGH). Reported by Tangeran ...
show more
Access to sensitive configuration files detected.. Threat Score: 7.2/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇹🇷
SeczarSecureOps
2026-08-10 04:51:56
(2 weeks ago)
Auto-blocked by Seczar SecureOps — Port Scan Detection (28 events in 10min) at 2026-08-10 04:51
Port Scan