🇩🇪
altenglaner
2026-11-14 06:57:03
UTC ·
(1 hour ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇩🇪
pltcldvlpr
2026-11-13 14:31:04
UTC ·
(18 hours ago)
CMS/framework probe: 162.158.172.237 - - [13/Nov/2026:15:31:04 +0100] "GET /.git/HEAD HTTP/2.0" 301 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0" asn=13335 org="Cloudflare, Inc." country=PL
...
Web App Attack
🇩🇪
FeG Deutschland
2026-11-13 12:48:46
UTC ·
(19 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 17:37:39
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:37:35.782320 2026] [security2:error] [pid 10199:tid 10199] [client 162.158.172.237:1269 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:37:35.782320 2026] [security2:error] [pid 10199:tid 10199] [client 162.158.172.237:12692] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gilesvolvocarselpaso.com.acadianahero.com"] [uri "/.git/config"] [unique_id "avX5Xx2FkzkO2nhVI0ZQcQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 15:43:57
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:43:50.829614 2026] [security2:error] [pid 17093:tid 17093] [client 162.158.172.237:1046 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:43:50.829614 2026] [security2:error] [pid 17093:tid 17093] [client 162.158.172.237:10466] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.lloydprins.com"] [uri "/.git/HEAD"] [unique_id "avXetsXgfNvevzRCxkymvQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-11-12 13:25:50
UTC ·
(1 day ago)
Accessed trap at '/.git/config'
Web App Attack
🇧🇪
boxed-it
2026-11-12 07:59:53
UTC ·
(2 days ago)
GET /.git/HEAD (Tarpitted for 18s, wasted 1.17kB)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 06:02:10
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:02:06.387275 2026] [security2:error] [pid 19055:tid 19055] [client 162.158.172.237:1153 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:02:06.387275 2026] [security2:error] [pid 19055:tid 19055] [client 162.158.172.237:11534] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.stormwlf.com"] [uri "/.git/HEAD"] [unique_id "avVWXkmFhKXpUXOJ6IMkzgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 05:31:14
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 00:31:09.745693 2026] [security2:error] [pid 10729:tid 10729] [client 162.158.172.237:1417 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 00:31:09.745693 2026] [security2:error] [pid 10729:tid 10729] [client 162.158.172.237:14171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cliniquecavalancia.com"] [uri "/.git/config"] [unique_id "avVPHa0LeTV-aagDsW6gqwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-12 04:51:28
UTC ·
(2 days ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 162.158.172.237 - - [12/Nov/2026:05:51:13 +0100] "GET /.git/HEAD HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Ge ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 162.158.172.237 - - [12/Nov/2026:05:51:13 +0100] "GET /.git/HEAD HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 22:28:24
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:28:17.944780 2026] [security2:error] [pid 14646:tid 14646] [client 162.158.172.237:1100 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:28:17.944780 2026] [security2:error] [pid 14646:tid 14646] [client 162.158.172.237:11009] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eurosoni.com"] [uri "/.git/HEAD"] [unique_id "avTsAdXimpBOC2D4nFBbiQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
informedclearly.com
2026-11-11 21:50:23
UTC ·
(2 days ago)
WAF_BAN reason=ENV_PROBE rule=ENV_PATH hits=1 path=/.git/HEAD? ua=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Hacking
🇺🇸
TPI-Abuse
2026-11-11 20:54:46
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:54:43.228275 2026] [security2:error] [pid 2354:tid 2354] [client 162.158.172.237:9739] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:54:43.228275 2026] [security2:error] [pid 2354:tid 2354] [client 162.158.172.237:9739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.alexthepunk.com"] [uri "/.git/HEAD"] [unique_id "avTWE5LaQJ3nkW_ikx8VqAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 20:31:35
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:31:29.665455 2026] [security2:error] [pid 24014:tid 24014] [client 162.158.172.237:9979 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:31:29.665455 2026] [security2:error] [pid 24014:tid 24014] [client 162.158.172.237:9979] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dianogah.com"] [uri "/.git/HEAD"] [unique_id "avTQoQVVVi-7FRskOXy3vAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 19:32:52
UTC ·
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 14:32:45.994989 2026] [security2:error] [pid 24574:tid 24574] [client 162.158.172.237:1326 ...
show more
(mod_security) mod_security (id:949110) triggered by 162.158.172.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 14:32:45.994989 2026] [security2:error] [pid 24574:tid 24574] [client 162.158.172.237:13266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ironmountainsports.com"] [uri "/.git/config"] [unique_id "avTC3QPYqPWMAm7ingO0xwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
