Anonymous
2026-09-22 16:36:02
(1 week ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
๐ฉ๐ช
4server
2026-09-17 21:23:58
(2 weeks ago)
[ThuSep1723:23:52.3016492026][security2:error][pid2703828:tid2703892][client162.158.88.66:0]ModSecur ...
show more
[ThuSep1723:23:52.3016492026][security2:error][pid2703828:tid2703892][client162.158.88.66:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"pulispina.ch.136-243-54-122.cpanel.site\"][uri\"/.env.test\"][unique_id\"aqxaaJX2PT_E14khafeauQAAAFY\"]\,referer:https://www.google.com/search\?q=pulispina.ch.136-243-54-122.cpanel.site
show less
Port Scan
Brute-Force
Web App Attack
๐ง๐ช
madeit
2026-09-17 01:13:03
(2 weeks ago)
Web App Attack
๐ฉ๐ช
FD-IX
2026-09-12 21:27:10
(2 weeks ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
Anonymous
2026-09-05 10:26:31
(3 weeks ago)
(caddyscan) Scanner path probe from 162.158.88.66 (SG/Singapore/-): 5 in the last 3600 secs; Ports: ...
show more
(caddyscan) Scanner path probe from 162.158.88.66 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 162.158.88.66 - - [05/Sep/2026:10:26:16 +0000] "HEAD /.env.local HTTP/1.1"
[REDACTED] 200 2627 162.158.88.66 - - [05/Sep/2026:10:26:19 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 162.158.88.66 - - [05/Sep/2026:10:26:19 +0000] "GET /.env.backup HTTP/1.1"
[REDACTED] 200 0 162.158.88.66 - - [05/Sep/2026:10:26:22 +0000] "HEAD /.env.sample HTTP/1.1"
[REDACTED] 200 2627 162.158.88.66 - - [05/Sep/2026:10:26:26 +0000] "GET /.vscode/settings.json HTTP/1.1"
show less
Port Scan
๐ฉ๐ช
Grossmann-Gruppe
2026-08-29 13:14:58
(1 month ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-08-18 01:15:06
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 21:14:59.011204 2026] [security2:error] [pid 19713:tid 19713] [client 162.158.88.66:9709] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.gescosigns.com"] [uri "/.git/config"] [unique_id "aoOyE5ZYcAXevXmbWEJHHQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-17 08:18:55
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 04:18:47.999147 2026] [security2:error] [pid 15396:tid 15396] [client 162.158.88.66:14222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cain2012.cain2016.org"] [uri "/.git/config"] [unique_id "aoLD5zQPneIB51NjlGH_ygAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-17 07:34:44
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 03:34:36.504361 2026] [security2:error] [pid 27116:tid 27116] [client 162.158.88.66:11850] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.touring.enchantmenttours.com"] [uri "/.git/config"] [unique_id "aoK5jNYzpybd2rTbagiw-gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-17 04:51:02
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 00:50:57.757526 2026] [security2:error] [pid 10866:tid 10939] [client 162.158.88.66:9376] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.busybeerestaurant.com"] [uri "/.git/config"] [unique_id "aoKTMfkW5r9YnREbcDeSHgAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-14 19:33:39
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.88.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 15:33:31.614056 2026] [security2:error] [pid 907933:tid 907933] [client 162.158.88.66:9910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anus.net"] [uri "/.git/config"] [unique_id "an9ti3kzrDHGfPWFCHKMbQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
mawan
2026-07-25 11:40:06
(2 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
๐ณ๐ฑ
COMPLEX
2026-06-12 01:17:51
(3 months ago)
Unsolicited TCP traffic | Action: DROP | Port 8443
Brute-Force
Anonymous
2026-06-05 17:24:05
(3 months ago)
162.158.88.66 - - > tecnicman.it [05/Jun/2026:19:24:01 +0200] "POST /wp-login.php HTTP/2.0" 301 162 ...
show more
162.158.88.66 - - > tecnicman.it [05/Jun/2026:19:24:01 +0200] "POST /wp-login.php HTTP/2.0" 301 162 "https://tecnicman.it/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0.1" "161.118.218.103"
162.158.88.66 - - > tecnicman.it [05/Jun/2026:19:24:02 +0200] "POST /wp-login.php HTTP/2.0" 301 162 "https://tecnicman.it/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36" "161.118.218.103"
162.158.88.66 - - > tecnicman.it [05/Jun/2026:19:24:03 +0200] "POST /wp-login.php HTTP/2.0" 301 162 "https://tecnicman.it/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" "161.118.218.103"
162.158.88.66 - - > tecnicman.it [05/Jun/2026:19:24:03 +0200] "POST /wp-login.php HTTP/2.0" 301 162 "https://tecnicman.it/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:92.0) Gecko/20100101 Firefox/92.0" "
...
show less
Hacking
Bad Web Bot
Web App Attack
๐ณ๐ฑ
homeshowdomain.nl
2026-05-07 22:01:13
(4 months ago)
Auto-ban: >3000 req/min op 2026-05-07
Web App Attack
SSH
Hacking