🇺🇸
TPI-Abuse
2026-11-15 01:02:12
UTC ·
(2 hours ago)
(mod_security) mod_security (id:949110) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 20:02:05.108941 2026] [security2:error] [pid 30999:tid 30999] [client 162.158.102.195:9325 ...
show more
(mod_security) mod_security (id:949110) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 20:02:05.108941 2026] [security2:error] [pid 30999:tid 30999] [client 162.158.102.195:9325] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sh-llc.net"] [uri "/.git/config"] [unique_id "avkEjT7qF3_BNMFB8468CgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 23:29:13
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:29:05.883227 2026] [security2:error] [pid 11419:tid 11419] [client 162.158.102.195:1167 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:29:05.883227 2026] [security2:error] [pid 11419:tid 11419] [client 162.158.102.195:11675] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ficklepassionproductions.com"] [uri "/.git/HEAD"] [unique_id "avjuwYoBrHp6r4CGNC_WMQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
vtchost.com
2026-11-14 22:46:01
UTC ·
(4 hours ago)
forbidden http request, scanning for weaknesses
...
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 22:03:12
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 17:03:07.402519 2026] [security2:error] [pid 14790:tid 15050] [client 162.158.102.195:1372 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 17:03:07.402519 2026] [security2:error] [pid 14790:tid 15050] [client 162.158.102.195:13729] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "soundstore.com"] [uri "/.git/HEAD"] [unique_id "avjam-kji_UV-SELr4lEbgAAAhg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-14 06:34:52
UTC ·
(20 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 04:30:56
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:30:50.635789 2026] [security2:error] [pid 22121:tid 22121] [client 162.158.102.195:9874 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:30:50.635789 2026] [security2:error] [pid 22121:tid 22121] [client 162.158.102.195:9874] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jiffycareers.com"] [uri "/.git/config"] [unique_id "avfj-sxO4QyMeOebGnRaTgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 03:53:25
UTC ·
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:53:18.019666 2026] [security2:error] [pid 1701:tid 1701] [client 162.158.102.195:10623] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:53:18.019666 2026] [security2:error] [pid 1701:tid 1701] [client 162.158.102.195:10623] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.intellian.us"] [uri "/.git/HEAD"] [unique_id "avfbLtHFxZZ2I_nMB76wwQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-14 03:53:05
UTC ·
(23 hours ago)
[Sat Nov 14 14:53:04.894567 2026] [security2:error] [pid 752679] [client 162.158.102.195:10750] [client 162.158.102.195] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/ ...
show more
[Sat Nov 14 14:53:04.894567 2026] [security2:error] [pid 752679] [client 162.158.102.195:10750] [client 162.158.102.195] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/.git/HEAD"] [unique_id "avfbIFw1-MiPclBehJ5sGgAAABE"]
...
show less
Web App Attack
🇩🇪
FeG Deutschland
2026-11-13 14:20:24
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 11:27:42
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:27:38.196500 2026] [security2:error] [pid 19789:tid 19789] [client 162.158.102.195:9840 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:27:38.196500 2026] [security2:error] [pid 19789:tid 19789] [client 162.158.102.195:9840] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.covid19.mavikalem.org"] [uri "/.git/config"] [unique_id "avb0KiWqwrsLsXMjmHXZXQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hagen Schoebel
2026-11-13 04:33:21
UTC ·
(1 day ago)
Blocked by CrowdSec - anomaly score block: lfi: 5, anomaly: 5, (PL)
Port Scan
Brute-Force
Web App Attack
SSH
🇺🇸
TPI-Abuse
2026-11-12 17:23:22
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:23:18.146279 2026] [security2:error] [pid 7700:tid 7700] [client 162.158.102.195:12788] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:23:18.146279 2026] [security2:error] [pid 7700:tid 7700] [client 162.158.102.195:12788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.edgecomix.com"] [uri "/.git/HEAD"] [unique_id "avX2BsRkcAAFv2DNuLwlVgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
ByteGuard Security Systems
2026-11-12 17:23:11
UTC ·
(2 days ago)
Automated scanner matched our decoy-secret-scan filter (1 request(s) starting 12/Nov/2026:20:23:11 +0300 MSK, UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0). Sample paths: GET /.git/HEAD. All requests returned 4 ...
show more
Automated scanner matched our decoy-secret-scan filter (1 request(s) starting 12/Nov/2026:20:23:11 +0300 MSK, UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0). Sample paths: GET /.git/HEAD. All requests returned 404/405 on a decoy host with no such resources.
show less
Hacking
Web App Attack
2026-11-12 14:59:43
UTC ·
(2 days ago)
apache vulnerability scan
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 11:08:39
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 06:08:34.922560 2026] [security2:error] [pid 18203:tid 18203] [client 162.158.102.195:1049 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 06:08:34.922560 2026] [security2:error] [pid 18203:tid 18203] [client 162.158.102.195:10492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ifmamasang.com"] [uri "/.git/config"] [unique_id "avWeMtLdbjB98s_kzCITbgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
