🇺🇸
TPI-Abuse
2026-11-11 20:51:03
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:50:57.283825 2026] [security2:error] [pid 8938:tid 8938] [client 162.158.102.36:13027] M ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:50:57.283825 2026] [security2:error] [pid 8938:tid 8938] [client 162.158.102.36:13027] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "limolaketahoe.com"] [uri "/.git/HEAD"] [unique_id "avTVMXWWjtcRZmkTVZtfVgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-11 05:26:30
UTC ·
(17 hours ago)
[Wed Nov 11 16:26:28.980165 2026] [security2:error] [pid 316013] [client 162.158.102.36:14305] [client 162.158.102.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/RE ...
show more
[Wed Nov 11 16:26:28.980165 2026] [security2:error] [pid 316013] [client 162.158.102.36:14305] [client 162.158.102.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "talentaymerch.com.au"] [uri "/.git/HEAD"] [unique_id "avP8hEOn_MaNfuetIUKubAAAAAE"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 13:15:03
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:14:53.643268 2026] [security2:error] [pid 783720:tid 783860] [client 162.158.102.36:1371 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:14:53.643268 2026] [security2:error] [pid 783720:tid 783860] [client 162.158.102.36:13712] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.kuwaitcounseling.com"] [uri "/.git/config"] [unique_id "avHHTY1mrO3HxWfjOXfhIQAAARg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 16:51:29
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 11:51:23.776171 2026] [security2:error] [pid 14275:tid 14275] [client 162.158.102.36:13601] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 11:51:23.776171 2026] [security2:error] [pid 14275:tid 14275] [client 162.158.102.36:13601] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "steeltech.alitcogroup.com"] [uri "/.git/config"] [unique_id "avCoi3x-NNwiEKraCAbUYgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 13:03:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 08:03:52.542307 2026] [security2:error] [pid 22408:tid 22408] [client 162.158.102.36:12279] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 08:03:52.542307 2026] [security2:error] [pid 22408:tid 22408] [client 162.158.102.36:12279] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staben.vccemail.net"] [uri "/.git/HEAD"] [unique_id "auiKOLImAfnNH9LzDqRa8QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 15:12:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 10:11:54.890583 2026] [security2:error] [pid 23592:tid 23592] [client 162.158.102.36:9287] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 10:11:54.890583 2026] [security2:error] [pid 23592:tid 23592] [client 162.158.102.36:9287] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "civilwarzone.andrewrmarshall.com"] [uri "/.git/HEAD"] [unique_id "audWupF0rt3ljT2xB2nwCQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 07:29:14
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 03:29:08.528041 2026] [security2:error] [pid 21126:tid 21126] [client 162.158.102.36:13244] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 03:29:08.528041 2026] [security2:error] [pid 21126:tid 21126] [client 162.158.102.36:13244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "odysseydogasporlari.com.handankoc.net"] [uri "/.git/HEAD"] [unique_id "atxeRFCuZfFxAT3OkbuedwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 05:11:04
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:10:59.136621 2026] [security2:error] [pid 539:tid 539] [client 162.158.102.36:11129] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.102.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:10:59.136621 2026] [security2:error] [pid 539:tid 539] [client 162.158.102.36:11129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.cor-ex.com"] [uri "/.git/HEAD"] [unique_id "atma45RvMGvGlQZf2xvh_AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-20 21:27:42
UTC ·
(3 weeks ago)
Web App Attack
🇫🇷
arsonist
2026-09-29 02:58:39
UTC ·
(1 month ago)
[fail2ban]
2026-09-29T02:58:39.107541+00:00 arson caddy[1890453]: {"level":"info","ts":1790650719.107511,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"162.158.102.36","remote_port":"12761","client_ip":"162.158.102 ...
show more
[fail2ban]
2026-09-29T02:58:39.107541+00:00 arson caddy[1890453]: {"level":"info","ts":1790650719.107511,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"162.158.102.36","remote_port":"12761","client_ip":"162.158.102.36","proto":"HTTP/2.0","method":"GET","host":"ayuworks.xyz","uri":"/.env","headers":{"Cdn-Loop":["cloudflare; loops=1"],"Accept":["*/*"],"Accept-Encoding":["gzip, br"],"Cf-Connecting-Ip":["45.138.12.52"],"X-Forwarded-Proto":["https"],"X-Forwarded-For":["45.138.12.52"],"Cf-Ray":["a427ba31cb0c3bbf-WAW"],"Cf-Ipcountry":["PL"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"ayuworks.xyz","ech":false}},"bytes_read":0,"user_id":"","duration":0.000105789,"
...
show less
Bad Web Bot
🇧🇪
madeit
2026-09-16 18:16:45
UTC ·
(1 month ago)
Web App Attack
🇺🇸
mawan
2026-08-03 06:19:18
UTC ·
(3 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
2026-07-05 20:10:42
UTC ·
(4 months ago)
2026-07-05T22:02:20.486055+02:00 nimbus sshd[15192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.102.36
2026-07-05T22:02:22.556425+02:00 nimbus sshd[15192]: Failed password for invalid user XTrap fr ...
show more
2026-07-05T22:02:20.486055+02:00 nimbus sshd[15192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.102.36
2026-07-05T22:02:22.556425+02:00 nimbus sshd[15192]: Failed password for invalid user XTrap from 162.158.102.36 port 19882 ssh2
2026-07-05T22:10:41.323004+02:00 nimbus sshd[17679]: Invalid user yonghong from 162.158.102.36 port 29270
...
show less
Brute-Force
SSH
🇺🇸
octageeks.com
2026-04-28 04:07:27
UTC ·
(6 months ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇩🇪
Bedios GmbH
2026-03-20 16:26:08
UTC ·
(7 months ago)
Login credentials theft attempt
Hacking
