🇮🇩
sockominfo
2026-04-30 08:00:42
(1 month ago)
Access to sensitive configuration files detected.. Threat Score: 5/10 (MEDIUM). Confidence: 40%. CVS ...
show more
Access to sensitive configuration files detected.. Threat Score: 5/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-04-30 07:00:40
(1 month ago)
Access to sensitive configuration files detected.. Threat Score: 5.1/10 (MEDIUM). Confidence: 40%. C ...
show more
Access to sensitive configuration files detected.. Threat Score: 5.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-04-30 06:00:17
(1 month ago)
Access to sensitive configuration files detected.. Threat Score: 7.2/10 (HIGH). Reported by Tangeran ...
show more
Access to sensitive configuration files detected.. Threat Score: 7.2/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-04-22 22:00:53
(1 month ago)
Auto-ban: >3000 req/min op 2026-04-22
Web App Attack
SSH
Hacking
🇮🇩
sockominfo
2026-04-14 15:00:41
(1 month ago)
Suspicious URL access., Access to sensitive configuration files detected.. Threat Score: 5.3/10 (MED ...
show more
Suspicious URL access., Access to sensitive configuration files detected.. Threat Score: 5.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 57%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-04-14 14:00:26
(1 month ago)
Access to sensitive configuration files detected.. Threat Score: 6.5/10 (MEDIUM). Reported by Tanger ...
show more
Access to sensitive configuration files detected.. Threat Score: 6.5/10 (MEDIUM). Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-04-01 14:05:26
(2 months ago)
Scanning/Probing (15)
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-03-31 00:06:11
(2 months ago)
Scanning/Probing (19)
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-03-29 23:05:37
(2 months ago)
Scanning/Probing (17)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-27 08:21:10
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 04:21:00.244648 2026] [security2:error] [pid 8918:tid 8918] [client 162.158.79.34:12878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.toomuchcaffeine.net"] [uri "/docker/.env"] [unique_id "acY97GfkuzesXh83_unYcwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-27 04:31:03
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 00:30:54.174123 2026] [security2:error] [pid 6209:tid 6299] [client 162.158.79.34:12801] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.deathbyaudiostore.com"] [uri "/.env.docker"] [unique_id "acYH_riZLDZUXow3sI8q4gAAAoU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-27 02:40:48
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 26 22:40:39.510860 2026] [security2:error] [pid 24027:tid 24027] [client 162.158.79.34:11709] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.gwenwaltersartrep.com"] [uri "/.env1"] [unique_id "acXuJ0ulmar2VIQkP4F1-AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-26 13:12:02
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 26 09:11:55.468900 2026] [security2:error] [pid 9122:tid 9122] [client 162.158.79.34:13814] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clickableprize.com"] [uri "/.env.staging"] [unique_id "acUwm-2wNIqYULNwSnK07gAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-26 12:45:36
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 26 08:45:31.293080 2026] [security2:error] [pid 31132:tid 31132] [client 162.158.79.34:13749] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.grasslakepizzatime.com"] [uri "/.env.php"] [unique_id "acUqaw8n0Xvri6PbOiiKAAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-26 03:54:46
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.79.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 23:54:38.712734 2026] [security2:error] [pid 27174:tid 27174] [client 162.158.79.34:11149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.tomweston.net"] [uri "/.env.test"] [unique_id "acSt_l7pLsG41F4gBKzrfAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack