🇬🇧
consul.to
2026-11-08 12:10:21
UTC ·
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
swalluw
2026-11-08 09:57:07
UTC ·
(2 days ago)
Web vulnerability scanning: request for /.env (HTTP 404, GET) at 2026-11-08T09:57:07+00:00 - exploit probe, no legitimate use
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2026-11-08 09:30:21
UTC ·
(3 days ago)
Triggered Cloudflare WAF (firewallCustom) from JP.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11. ...
show more
Triggered Cloudflare WAF (firewallCustom) from JP.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-11-08 08:59:26
UTC ·
(3 days ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 08:52:30
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:52:23.690849 2026] [security2:error] [pid 4809:tid 4809] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:52:23.690849 2026] [security2:error] [pid 4809:tid 4809] [client 149.88.103.76:61527] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "skyminor.com"] [uri "/.env"] [unique_id "avA4R1WpGFO40Lgv6jU0JgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 08:08:31
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:08:25.600978 2026] [security2:error] [pid 7530:tid 7530] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:08:25.600978 2026] [security2:error] [pid 7530:tid 7530] [client 149.88.103.76:30197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "romestudios.com"] [uri "/.env"] [unique_id "avAt-Z5CU7QyGv8yHQ-V7AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
sockominfo
2026-10-20 02:00:53
UTC ·
(3 weeks ago)
Email: Login failures from Bad Reputation IP: 149.88.103.76. Threat Score: 6.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1566 (Phishi ...
show more
Email: Login failures from Bad Reputation IP: 149.88.103.76. Threat Score: 6.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1566 (Phishing). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-10-20 01:00:53
UTC ·
(3 weeks ago)
Email: Login failures from Bad Reputation IP: 149.88.103.76. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1566 (Phishi ...
show more
Email: Login failures from Bad Reputation IP: 149.88.103.76. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1566 (Phishing). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇺🇸
lostswordfish.com
2026-09-22 14:14:03
UTC ·
(1 month ago)
Wordfence waf block on uvfousor WPIDD
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 00:24:55
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:24:48.539978 2026] [security2:error] [pid 19108:tid 19108] ...
show more
(mod_security) mod_security (id:225170) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:24:48.539978 2026] [security2:error] [pid 19108:tid 19108] [client 149.88.103.76:41463] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||capriexpress.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "capriexpress.com"] [uri "/wp-json/wp/v2/users"] [unique_id "arHK0HxGkc2VtvwMotZqewAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-09-21 19:02:56
UTC ·
(1 month ago)
Repeated requests for suspicious nonexistent URLs, for example: /wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmta-sts.perpendiculo.us&format=json (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like ...
show more
Repeated requests for suspicious nonexistent URLs, for example: /wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmta-sts.perpendiculo.us&format=json (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36")
show less
Web App Attack
🇩🇪
AlexEventfahrtenIPDB
2026-09-21 03:59:37
UTC ·
(1 month ago)
[Mon Sep 21 05:59:35.930036 2026] [authz_core:error] [pid 825174:tid 825231] [remote 149.88.103.76:51771] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://powerstar.spdns.de/
[Mon Sep 21 05:59 ...
show more
[Mon Sep 21 05:59:35.930036 2026] [authz_core:error] [pid 825174:tid 825231] [remote 149.88.103.76:51771] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://powerstar.spdns.de/
[Mon Sep 21 05:59:37.174934 2026] [authz_core:error] [pid 825174:tid 825218] [remote 149.88.103.76:51771] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://alex-eventfahrten.de/wp-login.php
...
show less
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-09-21 03:07:04
UTC ·
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-14 04:30:03
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 00:29:57.515493 2026] [security2:error] [pid 22218:tid 22218] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 00:29:57.515493 2026] [security2:error] [pid 22218:tid 22218] [client 149.88.103.76:56465] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "agrizel.menagri.com"] [uri "/.env"] [unique_id "an6ZxcmiClrfo4kBnr1oPAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-14 04:06:20
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 00:06:16.163660 2026] [security2:error] [pid 3215251:tid 3215 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.88.103.76 (unn-149-88-103-76.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 00:06:16.163660 2026] [security2:error] [pid 3215251:tid 3215251] [client 149.88.103.76:47379] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kentweakley.com"] [uri "/.env"] [unique_id "an6UOFaXQ6EIdL1Vbkc5aQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
