🇳🇦
jacqueskruger
2026-11-08 18:51:33
UTC ·
(14 hours ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-08T18:39:38Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-08T18:39:38Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
🇩🇪
on-com
2026-11-08 17:21:19
UTC ·
(16 hours ago)
URL scan
Brute-Force
Web App Attack
🇧🇷
radardatelecom
2026-11-08 16:55:04
UTC ·
(16 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-11-08 15:25:33
UTC ·
(18 hours ago)
(mod_security) mod_security (id:11000011) triggered by 149.102.234.137 (BR/Brazil/São Paulo/São Paulo/-/[AS212238 Datacamp Limited]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sun Nov 08 17:25:31.3 ...
show more
(mod_security) mod_security (id:11000011) triggered by 149.102.234.137 (BR/Brazil/São Paulo/São Paulo/-/[AS212238 Datacamp Limited]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sun Nov 08 17:25:31.323645 2026] [security2:error] [pid 10894:tid 11236] [client 149.102.234.137:60770] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "datapacket.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: unn-149-102-234-137.datapacket.com"] [severity "CRITICAL"] [hostname "adoro.gr"] [uri "/.env.bak"] [unique_id "avCUa40kENaFDYArYif7TAAAA0U"]
show less
Port Scan
🇺🇸
TPI-Abuse
2026-11-08 15:21:49
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 10:21:46.254238 2026] [security2:error] [pid 22582:tid 22 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 10:21:46.254238 2026] [security2:error] [pid 22582:tid 22582] [client 149.102.234.137:52933] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adorningmetal.com"] [uri "/.env"] [unique_id "avCTiqlNBVGBx2E_dbwohgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:54:37
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:54:34.216319 2026] [security2:error] [pid 30045:tid 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:54:34.216319 2026] [security2:error] [pid 30045:tid 30045] [client 149.102.234.137:55986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adona.info"] [uri "/.env"] [unique_id "avB_Gtq5rqIem5g95x3kmQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-11-08 12:47:30
UTC ·
(20 hours ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 11:06:10
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:06:06.601919 2026] [security2:error] [pid 16417:tid 16 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:06:06.601919 2026] [security2:error] [pid 16417:tid 16417] [client 149.102.234.137:50230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "admiralpointe.com"] [uri "/.env"] [unique_id "avBXnkRPRygNULdMhAr9YQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-08 10:33:17
UTC ·
(23 hours ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇫🇷
masterguru
2026-11-08 10:07:13
UTC ·
(23 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .d ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-197)
show less
Hacking
🇺🇸
TPI-Abuse
2026-11-08 08:57:07
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:56:59.772202 2026] [security2:error] [pid 9931:tid 993 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:56:59.772202 2026] [security2:error] [pid 9931:tid 9931] [client 149.102.234.137:54670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adm-sal.com"] [uri "/.env.staging"] [unique_id "avA5W5qst54RnmFZDPWI2QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-08 08:48:52
UTC ·
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇸🇪
vaia.cloud
2026-11-08 08:10:02
UTC ·
(1 day ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
2026-11-08 08:07:16
UTC ·
(1 day ago)
149.102.234.137 - - [08/Nov/2026:02:07:14 -0600] "GET /.env.backup HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 149.102.234.137
149.102.234.137 - - [08/Nov/202 ...
show more
149.102.234.137 - - [08/Nov/2026:02:07:14 -0600] "GET /.env.backup HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 149.102.234.137
149.102.234.137 - - [08/Nov/2026:02:07:14 -0600] "GET /.env.staging HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 149.102.234.137
149.102.234.137 - - [08/Nov/2026:02:07:14 -0600] "GET /.env.bak HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 149.102.234.137
149.102.234.137 - - [08/Nov/2026:02:07:14 -0600] "GET /.env.production HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 149.102.234.137
149.102.234.137 - - [08/Nov/2026:02:07:14 -0600] "GET /.env.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 07:11:04
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:10:59.471901 2026] [security2:error] [pid 4729:tid 472 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.137 (unn-149-102-234-137.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:10:59.471901 2026] [security2:error] [pid 4729:tid 4729] [client 149.102.234.137:62054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adj-tech.net"] [uri "/.env.production"] [unique_id "avAgg-UcBKCP1AHJ47GigAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
