141.94.20.103

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Confirmed malicious by STILWaters CTI (score=100)

Wordpress malicious attack:[octablocked]

Blocking for trying to access an exploit file: /.env

141.94.20.103 - - [28/Mar/2026:11:27:31 +0000] "GET /.env HTTP/1.1" 404 17063 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" ...

Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124

\[Sat Mar 28 05:47:21.890468 2026\] \[:error\] \[pid 391:tid 140546098042624\] \[client 141.94.20.103:43940\] \[client 141.94.20.103\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local ... show more \[Sat Mar 28 05:47:21.890468 2026\] \[:error\] \[pid 391:tid 140546098042624\] \[client 141.94.20.103:43940\] \[client 141.94.20.103\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "ut-addicted.com"\] \[uri "/.env"\] \[unique_id "acddWTipyH3Ze076tN@RqQAAAMY"\] show less

Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)

Web attack/malicious scanning detected