2026-11-12 04:35:20
UTC ·
(5 hours ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
FeG Deutschland
2026-11-12 01:16:54
UTC ·
(8 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 20:53:07
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:52:58.802791 2026] [security2:error] [pid 7471:tid 7471] [client 162.158.103.187:13654] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:52:58.802791 2026] [security2:error] [pid 7471:tid 7471] [client 162.158.103.187:13654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.celebritybikinigossip.com"] [uri "/.git/config"] [unique_id "avTVqt4NPim0Qoa77mUPhQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
MPL
2026-11-11 14:03:43
UTC ·
(20 hours ago)
tcp/443 (16 or more attempts)
Port Scan
2026-11-11 00:13:31
UTC ·
(1 day ago)
Trying to access config files
Web App Attack
🇩🇪
iNetWorker
2026-11-10 21:29:37
UTC ·
(1 day ago)
trolling for resource vulnerabilities
Web App Attack
2026-11-10 21:12:18
UTC ·
(1 day ago)
Fail2Ban jail zimbra-uri detected and blocked malicious activity against our mail server.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:38:27
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:38:24.328407 2026] [security2:error] [pid 1484:tid 1484] [client 162.158.103.187:12938] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:38:24.328407 2026] [security2:error] [pid 1484:tid 1484] [client 162.158.103.187:12938] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thebestac.com"] [uri "/.git/HEAD"] [unique_id "avLYANu4MGePyVtsFoZ8IQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 04:28:41
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:28:34.573911 2026] [security2:error] [pid 806:tid 806] [client 162.158.103.187:10945] M ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:28:34.573911 2026] [security2:error] [pid 806:tid 806] [client 162.158.103.187:10945] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.mathewsdental.com"] [uri "/.git/HEAD"] [unique_id "avKdcm1IddbnIUmYf7jKPwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
uthul
2026-11-10 03:16:21
UTC ·
(2 days ago)
T-Pot honeypot: 9 hits on ports [443] (automated)
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 02:05:47
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:05:41.224695 2026] [security2:error] [pid 22025:tid 22025] [client 162.158.103.187:9917 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.103.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:05:41.224695 2026] [security2:error] [pid 22025:tid 22025] [client 162.158.103.187:9917] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wsspy.bamedica.com"] [uri "/.git/config"] [unique_id "avJ79RaAlCY-Z1XvutviUQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-10 00:53:37
UTC ·
(2 days ago)
[Tue Nov 10 11:53:36.799169 2026] [security2:error] [pid 187101] [client 162.158.103.187:10118] [client 162.158.103.187] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/ ...
show more
[Tue Nov 10 11:53:36.799169 2026] [security2:error] [pid 187101] [client 162.158.103.187:10118] [client 162.158.103.187] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "embodiment.mareeshefford.com"] [uri "/.git/config"] [unique_id "avJrEHBt4qAO38nod_eq6gAAAAY"]
...
show less
Web App Attack
2026-11-10 00:06:07
UTC ·
(2 days ago)
Trying to access config files
Web App Attack
🇩🇪
tsZero
2026-11-09 23:02:21
UTC ·
(2 days ago)
Scan example: path=/.git/HEAD status=403
Hacking
🇧🇪
boxed-it
2026-11-09 22:59:43
UTC ·
(2 days ago)
GET /.git/config (Tarpitted for 19s, wasted 1.17kB)
Web App Attack
