๐ญ๐บ
Csaba Gรกspรกr
2026-06-16 13:37:00
(2 days ago)
HTPasswd.Access
Spring.Boot.Actuator.Unauthorized.Access
Hacking
๐ฉ๐ช
Prodscape
2026-06-16 12:08:46
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.202.102.215 (US/United States/-): 5 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 172.202.102.215 (US/United States/-): 5 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC
show less
Port Scan
๐ซ๐ท
dynamix
2026-06-16 11:33:12
(2 days ago)
Multiple WAF Violations
Web App Attack
๐ณ๐ด
jad-abuse
2026-06-16 10:40:47
(2 days ago)
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure ...
show more
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, env_probe, aws_creds, actuator. Observed by 1 sensor(s); 30 hits.
show less
Hacking
Web App Attack
๐ฉ๐ช
maxpower
2026-06-16 09:47:01
(2 days ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 172.202.102.215 (US/United States/-): 2 ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 172.202.102.215 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 172.202.102.215 - - [16/Jun/2026:11:46:57 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" host=51.77.95.116
172.202.102.215 - - [16/Jun/2026:11:46:57 +0200] "GET /.aws/credentials HTTP/1.1" 404 10393 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" host=51.77.95.116
show less
Port Scan
๐จ๐ญ
Zdenฤk Svancar
2026-06-16 08:42:19
(2 days ago)
172.202.102.215 - - [16/Jun/2026:08:42:05 +0000] "GET /.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Maci ...
show more
172.202.102.215 - - [16/Jun/2026:08:42:05 +0000] "GET /.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
172.202.102.215 - - [16/Jun/2026:08:42:17 +0000] "GET /wp-config.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Port Scan
Bad Web Bot
Web App Attack
๐ช๐ธ
DXC-0
2026-06-03 03:00:21
(2 weeks ago)
Multiple attacks on Honeypot servers
Web Spam
Brute-Force
Web App Attack
Hacking
๐บ๐ธ
xmission.com
2026-06-02 06:31:54
(2 weeks ago)
Blocked by UFW (TCP on 443)
Source port: 47109
TTL: 52
Packet length: 60
TOS: 0x00
This report (for ...
show more
Blocked by UFW (TCP on 443)
Source port: 47109
TTL: 52
Packet length: 60
TOS: 0x00
This report (for 172.202.102.215) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Web App Attack
๐น๐ญ
Sawasdee
2026-06-02 06:30:10
(2 weeks ago)
Unwanted checking 80 or 443 port
...
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-06-02 06:22:20
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.202.102.215 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 172.202.102.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 02:22:14.260243 2026] [security2:error] [pid 9905:tid 9905] [client 172.202.102.215:47152] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||192.64.150.216|F|2"] [data ".env.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.216"] [uri "/.env.backup"] [unique_id "ah52llIOsNoRj7DP0FQxGAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-02 05:13:51
(2 weeks ago)
Honeypot hit: Empty payload (likely service probe); 2087 [4], 2086 [1], 2083 [1], 2082 [1] TCP
Repor ...
show more
Honeypot hit: Empty payload (likely service probe); 2087 [4], 2086 [1], 2083 [1], 2082 [1] TCP
Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB
show less
Port Scan
๐บ๐ธ
kosada.com
2026-06-02 04:56:13
(2 weeks ago)
Web vulnerability probing: /.env.production (bogus vhost/SNI)
Web App Attack
๐ง๐ท
SOC PR
2026-06-02 04:21:55
(2 weeks ago)
IPS: Sensitive Configuration File Disclosure.
Hacking
๐ฌ๐ง
djboddington
2026-06-02 03:31:10
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
๐ต๐ฑ
sefinek.net
2026-06-02 03:27:37
(2 weeks ago)
Honeypot hit: Empty payload (likely service probe); 2087 [4], 2083 [1], 2082 [1] TCP
Reported by: ht ...
show more
Honeypot hit: Empty payload (likely service probe); 2087 [4], 2083 [1], 2082 [1] TCP
Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB
show less
Port Scan