🇦🇺
paulshipley.com.au
2026-11-11 04:45:40
UTC ·
(12 hours ago)
[Wed Nov 11 15:45:39.905600 2026] [security2:error] [pid 341261] [client 172.68.159.206:12043] [client 172.68.159.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/RE ...
show more
[Wed Nov 11 15:45:39.905600 2026] [security2:error] [pid 341261] [client 172.68.159.206:12043] [client 172.68.159.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stkildashule.org.au"] [uri "/.git/HEAD"] [unique_id "avPy80oxaDUMhCxtBvh9ZAAAAAc"]
...
show less
Web App Attack
🇩🇪
Hary74656
2026-11-10 14:50:45
UTC ·
(1 day ago)
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 172.68.159.206] [realclient 172.68.159.206] [10/Nov/2026:15:50:44 +0100] [vhost tools.aschi.at] 403 "GET /.git/HEAD HTTP/2.0"
Web App Attack
🇩🇪
FeG Deutschland
2026-11-10 13:47:16
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:43:16
UTC ·
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:43:08.624373 2026] [security2:error] [pid 6029:tid 6029] [client 172.68.159.206:9885] Mo ...
show more
(mod_security) mod_security (id:949110) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:43:08.624373 2026] [security2:error] [pid 6029:tid 6029] [client 172.68.159.206:9885] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web239.dnchosting.com"] [uri "/.git/HEAD"] [unique_id "avMDTHLVac1PkZ79YsIMZQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-11-10 04:22:39
UTC ·
(1 day ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
moppetto
2026-11-10 01:32:38
UTC ·
(1 day ago)
.git/config credential scraping; GET /.git/config
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-10 00:20:21
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:20:17.617394 2026] [security2:error] [pid 6389:tid 6389] [client 172.68.159.206:11618] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:20:17.617394 2026] [security2:error] [pid 6389:tid 6389] [client 172.68.159.206:11618] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "martaaizenman.com"] [uri "/.git/HEAD"] [unique_id "avJjQQ7DnhblyMYPNpmPlwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-11-10 00:07:25
UTC ·
(1 day ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-09T06:45:07.000Z.
Web App Attack
🇩🇪
todix
2026-11-09 19:21:09
UTC ·
(1 day ago)
"GET /.git/HEAD HTTP/2.0" 403 269 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 14:52:15
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 09:52:11.826222 2026] [security2:error] [pid 24160:tid 24160] [client 172.68.159.206:12008] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 09:52:11.826222 2026] [security2:error] [pid 24160:tid 24160] [client 172.68.159.206:12008] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.darkalleyproductions.com"] [uri "/.git/HEAD"] [unique_id "avHeG5ViFCWC-_Ob6orcxQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-09 14:26:17
UTC ·
(2 days ago)
[mx01aln] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 172.68.159.206 - - [09/Nov/2026:15:26:01 +0100] "GET /.git/HEAD HTTP/2.0" 301 490 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/ ...
show more
[mx01aln] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 172.68.159.206 - - [09/Nov/2026:15:26:01 +0100] "GET /.git/HEAD HTTP/2.0" 301 490 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0"
172.68.159.206 - - [09/Nov/2026:15:26:01 +0100] "GET /.git/config HTTP/2.0" 301 490 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 12:37:15
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:37:09.655160 2026] [security2:error] [pid 9708:tid 9708] [client 172.68.159.206:13368] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:37:09.655160 2026] [security2:error] [pid 9708:tid 9708] [client 172.68.159.206:13368] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "springmeadowventures.com"] [uri "/.git/config"] [unique_id "avG-danboDCUi_e0HrsRxAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 12:18:11
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:18:04.273358 2026] [security2:error] [pid 8492:tid 8492] [client 172.68.159.206:13467] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:18:04.273358 2026] [security2:error] [pid 8492:tid 8492] [client 172.68.159.206:13467] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lognlumber.com"] [uri "/.git/HEAD"] [unique_id "avG5_Nv9DkqFNWhRM176OgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 10:55:18
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 05:55:11.116234 2026] [security2:error] [pid 23081:tid 23081] [client 172.68.159.206:12743] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 05:55:11.116234 2026] [security2:error] [pid 23081:tid 23081] [client 172.68.159.206:12743] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.hydrogenplus.net"] [uri "/.git/config"] [unique_id "avGmj_vU_TmPneAKd-uM8wAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 09:10:57
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 04:10:50.071544 2026] [security2:error] [pid 26754:tid 26754] [client 172.68.159.206:11189] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.159.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 04:10:50.071544 2026] [security2:error] [pid 26754:tid 26754] [client 172.68.159.206:11189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.pete-n-sheila.net"] [uri "/.git/config"] [unique_id "avGOGkOmEh7nsa4XPJ_HTQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
