🇧🇬
Stoyko Stoykov
2026-09-06 14:13:24
(12 hours ago)
162.158.154.181 - - [06/Sep/2026:17:13:24 +0300] "GET /.git/config HTTP/2.0" 404 1852 "-" "Mozilla/5 ...
show more
162.158.154.181 - - [06/Sep/2026:17:13:24 +0300] "GET /.git/config HTTP/2.0" 404 1852 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 13:16:21
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 09:16:15.248547 2026] [security2:error] [pid 22754:tid 22754] [client 162.158.154.181:12025] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.phuket-day-trip.com"] [uri "/.git/config"] [unique_id "apA4n3O3N_LwUjqbWCXH3wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 12:45:06
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 08:44:58.957163 2026] [security2:error] [pid 22644:tid 22663] [client 162.158.154.181:13086] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.delapiazza.com"] [uri "/.git/HEAD"] [unique_id "ao7fylV6fmkkhsxb7tMpmAAAANA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
securejdprop
2026-08-21 07:29:06
(2 weeks ago)
This IP was detected by CrowdSec triggering custom/vpatch-bad-cloudflare.
Hacking
🇧🇪
madeit
2026-08-18 07:16:26
(2 weeks ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 03:03:12
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 23:03:04.416447 2026] [security2:error] [pid 22822:tid 22822] [client 162.158.154.181:10647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.terazon.net"] [uri "/.git/config"] [unique_id "aoJ56NQRG3sjgIDcXI7GVAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-29 15:17:11
(3 months ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇩🇪
acadeova
2026-05-05 18:25:17
(4 months ago)
🚨 Recon detected (nft drop)
SRC=162.158.154.181
Observed=TCP dpt=80 in=enp0s6 ttl=57
Time=recent(jou ...
show more
🚨 Recon detected (nft drop)
SRC=162.158.154.181
Observed=TCP dpt=80 in=enp0s6 ttl=57
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
🇺🇸
octageeks.com
2026-04-10 04:08:11
(4 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 07:06:56
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 03:06:51.640952 2026] [security2:error] [pid 27023:tid 27023] [client 162.158.154.181:11259] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.termstech.com"] [uri "/private/.env"] [unique_id "abzyC2YEWETUmYGfgzuZ6QAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:38:51
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:38:46.659590 2026] [security2:error] [pid 2524024:tid 2524024] [client 162.158.154.181:14276] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.kevinfranz.com"] [uri "/.env_settings"] [unique_id "abzrdsawv7pkdrGCK7-_uAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:19:20
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:19:12.508962 2026] [security2:error] [pid 6466:tid 6466] [client 162.158.154.181:9597] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aim-controls.com"] [uri "/.env.dist"] [unique_id "abzm4B9E0A_u3ry0AfB7jQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:57:37
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:57:32.093198 2026] [security2:error] [pid 20066:tid 20066] [client 162.158.154.181:14168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.canadacustombox.com"] [uri "/.env.test"] [unique_id "abzTvBNoEvSInHVGg4dsXAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:37:43
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:37:35.263136 2026] [security2:error] [pid 11214:tid 11214] [client 162.158.154.181:9985] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.instagenii.ficklepassionproductions.com"] [uri "/.env.old"] [unique_id "abzPD3LJDiXSvOsu-YUexQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:07:32
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.154.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:07:22.662871 2026] [security2:error] [pid 24964:tid 24964] [client 162.158.154.181:10269] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.n3fjp.com"] [uri "/.env.test"] [unique_id "abyr2jZxsDRwh54JoO_bWAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
