🇲🇳
Public CSIRT/CC of Mongolia
2026-06-19 16:03:03
(10 hours ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-19 11:57:53
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 07:57:47.987029 2026] [security2:error] [pid 20612:tid 20612] [client 141.98.101.182:44860] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.garyandthegroove.com"] [uri "/.env.old"] [unique_id "ajUuuz7IsRFaglg2wD7AQQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-19 05:27:21
(21 hours ago)
Automated report (2026-06-19T01:27:21-04:00). Caught probing for env file.
Hacking
Web App Attack
🇨🇿
lp
2026-06-18 13:51:54
(1 day ago)
Email account brute force: 1 attempts were recorded from 141.98.101.182
2026-06-18T15:22:02+02:00 wa ...
show more
Email account brute force: 1 attempts were recorded from 141.98.101.182
2026-06-18T15:22:02+02:00 warning: unknown[141.98.101.182]: SASL PLAIN authentication failed: authentication failure, [email protected]
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-17 09:12:02
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 05:11:59.075916 2026] [security2:error] [pid 6621:tid 6621] [client 141.98.101.182:50950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.construction.bonefrog.com"] [uri "/.hermes/.env"] [unique_id "ajJk3yIVuWHmAw6Do2iC4AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-06-17 08:28:30
(2 days ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇬🇧
OptimusGO
2026-06-17 05:22:27
(2 days ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-17 06:22:27 UTC
Log evidence:
06/17/2026-06:22:26.646014 [**] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [**] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 141.98.101.182:43452 -> 185.127.18.66:8088
show less
Port Scan
Brute-Force
🇺🇸
TPI-Abuse
2026-06-16 05:13:39
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 01:13:34.449707 2026] [security2:error] [pid 18585:tid 18608] [client 141.98.101.182:34242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "richardleeweatherman.com"] [uri "/.env.example"] [unique_id "ajDbfmPnUBEwcOOdRofTSAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 01:41:24
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 141.98.101.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 21:41:19.204477 2026] [security2:error] [pid 27831:tid 27831] [client 141.98.101.182:45908] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ilandman.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ilandman.com"] [uri "/telegram_messages.db"] [unique_id "ajCpvymf0vKjPtKcVziAdAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-06-15 23:28:26
(4 days ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇮🇹
VHosting
2026-06-12 02:17:54
(1 week ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇮🇱
spd.co.il
2026-05-22 09:04:11
(4 weeks ago)
Web application attack detected
Hacking
Web App Attack
🇧🇷
dominioz
2026-05-22 01:24:47
(4 weeks ago)
Brute-Force
🇧🇷
dominioz
2026-05-21 19:53:35
(4 weeks ago)
Brute-Force
🇧🇷
dominioz
2026-05-21 18:45:41
(4 weeks ago)
Brute-Force