🇧🇷
ICS Labs
2026-11-13 16:48:43
UTC ·
(20 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-13 UTC.
Brute-Force
🇺🇸
TPI-Abuse
2026-11-13 02:59:12
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 161.120.217.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:59:04.803925 2026] [security2:error] [pid 22203:tid 22290] [client 161.120.217.166:5534 ...
show more
(mod_security) mod_security (id:210492) triggered by 161.120.217.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:59:04.803925 2026] [security2:error] [pid 22203:tid 22290] [client 161.120.217.166:55348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "surdick.com"] [uri "/.git/config"] [unique_id "avZ8-Mm-UDdyEsPfvej9kwAAARE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 02:37:29
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 161.120.217.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:37:24.295625 2026] [security2:error] [pid 16095:tid 16095] [client 161.120.217.166:3338 ...
show more
(mod_security) mod_security (id:210492) triggered by 161.120.217.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:37:24.295625 2026] [security2:error] [pid 16095:tid 16095] [client 161.120.217.166:33386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "suralcopensioendesk.com"] [uri "/.git/config"] [unique_id "avZ35OHxeHJ0ezKIxRVSgAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-11-13 02:03:24
UTC ·
(1 day ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
EGP Abuse Dept
2026-11-13 01:05:37
UTC ·
(1 day ago)
Scanning for web/db/file exploits on support.waanders.studio
SQL Injection
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-12 23:50:10
UTC ·
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-12 23:44:06
UTC ·
(1 day ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 7 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 7 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Sa
Requested, e.g.:
- support.[REDACTED]/
- support.[REDACTED]/.git/config
show less
Web App Attack
🇵🇱
MatStef132
2026-11-12 23:39:20
UTC ·
(1 day ago)
MatShield L7: blocked on a protected site (secret-path-probe)
DDoS Attack
🇸🇬
simpeg-adm.bandung.go.id
2026-11-12 21:15:14
UTC ·
(1 day ago)
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/.git/config"
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/"
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/.env"
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/.env.local"
12/Nov/2026:21:15:13 +0000;161.120.21 ...
show more
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/.git/config"
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/"
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/.env"
12/Nov/2026:21:15:12 +0000;161.120.217.166;"/.env.local"
12/Nov/2026:21:15:13 +0000;161.120.217.166;"/.env.production"
12/Nov/2026:21:15:13 +0000;161.120.217.166;"/.env.staging"
12/Nov/2026:21:15:13 +0000;161.120.217.166;"/.env.development"
...
show less
Web Spam
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-11-12 19:44:47
UTC ·
(1 day ago)
Automated web vulnerability and path enumeration scan with excessive 404 requests
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2026-11-12 04:58:55
UTC ·
(2 days ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /_profiler/phpinfo | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 • Generated by: git ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /_profiler/phpinfo | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
2000cn.com.au
2026-11-12 03:27:11
UTC ·
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇳🇱
Site.eu
2026-11-11 03:28:13
UTC ·
(3 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇮🇹
mgarofano80
2026-11-11 00:37:48
UTC ·
(3 days ago)
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-09 17:07:19
UTC ·
(4 days ago)
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 161.120.217.166 - - [09/Nov/2026:18:07:13 +0100] "GET /.git/config HTTP/1.1" 301 504 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWe ...
show more
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 161.120.217.166 - - [09/Nov/2026:18:07:13 +0100] "GET /.git/config HTTP/1.1" 301 504 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
