🇫🇮
iamxorum
2026-09-10 21:48:02
(10 hours ago)
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-09-10T21:48:01.54 ...
show more
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-09-10T21:48:01.543234+00:00 XRM-01 kernel: [437519.013609] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=162.158.154.141 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=55753 DF PROTO=TCP SPT=9858 DPT=8443 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇲🇽
octageeks.com
2026-06-28 04:09:29
(2 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇲🇽
octageeks.com
2026-06-21 04:07:21
(2 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇲🇽
octageeks.com
2026-06-05 04:06:24
(3 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:34:50
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:34:44.977198 2026] [security2:error] [pid 10152:tid 10152] [client 162.158.154.141:10893] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.capitalcitysoul.com.calvaryshreveport.org"] [uri "/.git/refs/heads/main"] [unique_id "abzqhL5BgktOst8vGbu47gAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 00:35:59
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 20:35:53.181874 2026] [security2:error] [pid 12571:tid 12571] [client 162.158.154.141:13105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.int.mavikalem.org"] [uri "/.env.production.local"] [unique_id "abyWaQKjPVpF5kK7t6qHAQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 11:56:25
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:56:18.474362 2026] [security2:error] [pid 1396264:tid 1396264] [client 162.158.154.141:14258] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mena365.gulftelecom.com"] [uri "/.git/logs/HEAD"] [unique_id "abvkYpBtGu85eAMwhRmjIwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 11:10:11
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:09:58.079030 2026] [security2:error] [pid 17792:tid 17792] [client 162.158.154.141:11435] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.fltsiminc.com"] [uri "/.git/refs/heads/master"] [unique_id "abvZhscRdtSXzpvKO7RN1gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 10:36:11
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 06:36:03.432978 2026] [security2:error] [pid 5532:tid 5532] [client 162.158.154.141:11210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.gayarab.com"] [uri "/admin/.env"] [unique_id "abvRk1Uo6dpdPPmBL2kFygAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 09:58:54
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 05:58:47.285159 2026] [security2:error] [pid 22935:tid 22984] [client 162.158.154.141:12585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sujugada.com"] [uri "/.env_config"] [unique_id "abvI171QG2eCjQwkLUfj9wAAAME"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 08:59:36
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 04:59:30.776883 2026] [security2:error] [pid 21022:tid 21022] [client 162.158.154.141:9365] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.scottwithers.net"] [uri "/.env_secret"] [unique_id "abu68rw-idq2cxhSTxAgwwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 08:44:29
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 04:44:26.280981 2026] [security2:error] [pid 21128:tid 21128] [client 162.158.154.141:10801] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.mypensees.com"] [uri "/docker/.env"] [unique_id "abu3akBPuDkhNKJIUy672wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 08:03:40
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 04:03:33.915446 2026] [security2:error] [pid 19140:tid 19215] [client 162.158.154.141:13704] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.conservativelabor.com"] [uri "/.env.example"] [unique_id "abut1TWARfUwpST0t8MCZgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 07:25:57
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 03:25:51.481856 2026] [security2:error] [pid 28830:tid 28830] [client 162.158.154.141:11860] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.myouenji.org"] [uri "/web/.env"] [unique_id "abuk_2ZcJk7d4T5XC0MnywAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 06:14:31
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 02:14:27.711506 2026] [security2:error] [pid 29171:tid 29209] [client 162.158.154.141:12326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "grupojdg.neotienda.com"] [uri "/.env.development"] [unique_id "abuUQwK3Xczctk1_BA07TgAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
