2024-02-22 01:24:25
(2 years ago)
port scan and connect, tcp 22 (ssh)
Port Scan
🇩🇪
Fusl
2024-02-21 18:35:24
(2 years ago)
received unsolicited smtp data stream:
Content-Type: multipart/alternative; boundary="----=_Boundary ...
show more
received unsolicited smtp data stream:
Content-Type: multipart/alternative; boundary="----=_Boundary_37324_255579131.5531877298596"
MIME-Version: 1.0
From: Heather Hensley <[email protected] >
To: rdoconnor2001 <[email protected] >
Subject: Subject: Immediate Action Required [ #ID:QGZWSW4DJBATDYF ]
Date: Wed, 21 Feb 2024 18:35:06 GMT
Message-Id: <[email protected] >
------=_Boundary_37324_255579131.5531877298596
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
CHASEartist=E2=80=8A Dear rdoconnor2001, We have noticed some unusual acti=
vity as we are working 24/7 to keep your account safe, we request some addi=
tional information. Confirm your identity or contact customer service for m=
ore information +1 (100) 7935-9935Confirm my identitySincerely, Chase Custo=
mer Support Team Warning! Ignoring any of these steps may cause several iss=
ues!
------=_Boundary_37324_255579131.553187729
show less
Email Spam
🇹🇷
GHS
2024-02-14 12:57:00
(2 years ago)
154.6.81.9 - - [14/Feb/2024:15:47:34 +0300] "GET /.env HTTP/1.0" 403 199
Web App Attack
🇺🇸
TPI-Abuse
2024-02-14 12:52:49
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 14 07:52:42.042092 2024] [security2:error] [pid 12483] [client 154.6.81.9:61183] [client 154.6.81.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rubypines.com"] [uri "/.env"] [unique_id "Zcy3mqOm1KbDeqsBhSaOJQAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-02-14 12:33:17
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 14 07:33:14.170278 2024] [security2:error] [pid 9096] [client 154.6.81.9:62360] [client 154.6.81.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeromebrownmba.com"] [uri "/.env"] [unique_id "ZcyzCuGw7Dtp-da6gFbTiwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-02-14 12:12:00
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 14 07:11:54.301283 2024] [security2:error] [pid 18923] [client 154.6.81.9:57972] [client 154.6.81.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pigneat.com"] [uri "/.env"] [unique_id "ZcyuCnLcx3jfir--sk4PuQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-02-14 12:00:07
(2 years ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇺🇸
TPI-Abuse
2024-02-14 11:53:20
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 154.6.81.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 14 06:53:16.532668 2024] [security2:error] [pid 23141] [client 154.6.81.9:49405] [client 154.6.81.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nickp.us"] [uri "/.env"] [unique_id "ZcyprEpZqVLeERfwIXVlbwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2023-12-26 21:13:34
(2 years ago)
Aggressive web scan
Web App Attack
2023-12-20 00:13:30
(2 years ago)
Aggressive web scan
Web App Attack
2023-11-30 13:52:22
(2 years ago)
Unauthorized connection attempt detected in the last 24 hours
Hacking
2023-11-27 13:50:08
(2 years ago)
Unauthorized connection attempt detected in the last 24 hours
Hacking
2023-11-24 13:40:02
(2 years ago)
Unauthorized connection attempt detected in the last 24 hours
Hacking
2023-11-21 13:30:08
(2 years ago)
Unauthorized connection attempt detected in the last 24 hours
Hacking
2023-11-18 13:20:10
(2 years ago)
Unauthorized connection attempt detected in the last 24 hours
Hacking