🇧🇷
KingHost
2026-10-15 05:31:51
UTC ·
(3 weeks ago)
Brute-Force
🇮🇩
sockominfo
2026-08-25 16:00:53
UTC ·
(2 months ago)
Email: Login failures from Bad Reputation IP: 149.102.234.29. Threat Score: 6.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1566 (Phish ...
show more
Email: Login failures from Bad Reputation IP: 149.102.234.29. Threat Score: 6.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1566 (Phishing). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-08-25 15:00:10
UTC ·
(2 months ago)
Email: Login failures from Bad Reputation IP: 149.102.234.29. Threat Score: 5.6/10 (MEDIUM). Reported by TangerangKota-CSIRT
Hacking
Web App Attack
🇮🇩
sockominfo
2026-08-25 14:00:09
UTC ·
(2 months ago)
Email: Login failures from Bad Reputation IP: 149.102.234.29. Threat Score: 5.7/10 (MEDIUM). Reported by TangerangKota-CSIRT
Hacking
Web App Attack
🇧🇪
cmbplf
2026-08-24 03:24:15
UTC ·
(2 months ago)
745 requests with url.path //xmlrpc.php
185 requests with url.path */wp-includes/wlwmanifest.xml
Brute-Force
Bad Web Bot
🇧🇷
somosbr
2026-05-25 08:42:52
UTC ·
(5 months ago)
[2026-05-25T08:42:52Z] Unsolicited scan from 149.102.234.29 to port 3389/tcp
Port Scan
🇧🇷
Host One
2026-05-25 08:42:11
UTC ·
(5 months ago)
[Honeypot] Malicious activity detected by honeypot on port 3389. IP attempted unauthorized access to decoy service. Original message: RDP brute force attack from honeypot - User: connection_attempt. Attempted credentials captured.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-17 07:07:26
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 03:07:18.388525 2026] [security2:error] [pid 11121:tid 1112 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 03:07:18.388525 2026] [security2:error] [pid 11121:tid 11121] [client 149.102.234.29:58828] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "developerdove.com"] [uri "/.env"] [unique_id "aglpJgq6dRzt8aK7bb9GrAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-17 06:48:47
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 02:48:42.596381 2026] [security2:error] [pid 5905:tid 5905] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 02:48:42.596381 2026] [security2:error] [pid 5905:tid 5905] [client 149.102.234.29:60089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "designamb.com"] [uri "/.env"] [unique_id "aglkynUga2OcGVSKLUt0CAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jcbriar
2026-05-17 06:38:24
UTC ·
(5 months ago)
Searching for vulnerable scripts
Hacking
Web App Attack
2026-05-17 06:37:35
UTC ·
(5 months ago)
149.102.234.29 - - [17/May/2026:08:37:33 +0200] "GET /.env HTTP/2.0" 301 169 "-" "Mozilla/5.0 (Android 16; Mobile; rv:148.0) Gecko/148.0 Firefox/148.0"
Web App Attack
🇺🇸
dtorrer
2026-05-17 06:34:48
UTC ·
(5 months ago)
General vulnerability scan.
Port Scan
🇺🇸
TPI-Abuse
2026-05-17 06:32:30
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 02:32:24.728937 2026] [security2:error] [pid 22472:tid 2247 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 02:32:24.728937 2026] [security2:error] [pid 22472:tid 22472] [client 149.102.234.29:51119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "denvercitymotorparts.com"] [uri "/.env"] [unique_id "aglg-BAIy12KtEiZ-4LpnwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-17 06:18:37
UTC ·
(5 months ago)
IM360 WAF: Direct access to sensitive file or dotfile MV:/.env
Web App Attack
🇺🇸
TPI-Abuse
2026-05-17 06:14:24
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 02:14:17.871605 2026] [security2:error] [pid 6913:tid 6913] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.102.234.29 (unn-149-102-234-29.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 02:14:17.871605 2026] [security2:error] [pid 6913:tid 6913] [client 149.102.234.29:49918] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "delta-pizza.com"] [uri "/.env"] [unique_id "aglcubZjqIO0-xkXtWiM4AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
