🇺🇸
TPI-Abuse
2026-06-04 10:48:57
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.148 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 06:48:52.724440 2026] [security2:error] [pid 4683:tid 4683] [client 208.84.101.148:52620] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thebradleyclinic.com"] [uri "/.env.development"] [unique_id "aiFYFGe1GiZbT7PrY1z9vwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
london2038.com
2026-06-03 18:35:03
(1 week ago)
Probing for exploits
208.84.101.148 - - [03/Jun/2026:20:35:02 +0200] "GET /cms/.env HTTP/1.1" 422 0 ...
show more
Probing for exploits
208.84.101.148 - - [03/Jun/2026:20:35:02 +0200] "GET /cms/.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36"
208.84.101.148 - - [03/Jun/2026:20:35:02 +0200] "GET /backend/.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36"
show less
Hacking
Web App Attack
🇩🇪
MusicLibrary
2026-06-03 13:08:32
(1 week ago)
Attempted access to sensitive configuration files (.env, .git, etc.)
Bad Web Bot
Web App Attack
2026-06-02 02:00:08
(1 week ago)
WordPress vulnerability scanning and Lottery/prize scamming detected
Bad Web Bot
Web App Attack
🇮🇩
soc-yk
2026-05-30 02:18:12
(1 week ago)
Type: suspicious_network_activity
Threat: unknown
Risk: 100
Events: 81
Evidence:
- Persistent suspi ...
show more
Type: suspicious_network_activity
Threat: unknown
Risk: 100
Events: 81
Evidence:
- Persistent suspicious network activity detected
- Repeated hostile operational behavior observed
- Multi-event operational persistence identified
- Threat escalation behavior observed
show less
Port Scan
Hacking
🇮🇩
penjaga BRIN
2026-05-25 06:56:58
(2 weeks ago)
Web application attack
Web App Attack
🇮🇩
penjaga BRIN
2026-05-20 23:00:35
(3 weeks ago)
Web application attack
Web App Attack
🇮🇩
Burayot
2026-05-04 09:01:30
(1 month ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 208.84.101.148 (US/United States/-): ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 208.84.101.148 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇮🇩
sockominfo
2026-04-26 11:00:48
(1 month ago)
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes, Suspicious URL access.. Th ...
show more
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes, Suspicious URL access.. Threat Score: 7.8/10 (HIGH). Confidence: 60%. CVSS v3.1: 7.3/10 (High). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 93%. MITRE ATT&CK: T1071 (Application Layer Protocol). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-04-26 10:00:51
(1 month ago)
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes, Suspicious URL access.. Th ...
show more
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes, Suspicious URL access.. Threat Score: 7.9/10 (HIGH). Confidence: 60%. CVSS v3.1: 7.3/10 (High). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 96%. MITRE ATT&CK: T1071 (Application Layer Protocol). Tactic: TA0001. Freshness: Fresh. Source Reputation: SUSPICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-04-26 08:00:43
(1 month ago)
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes. Threat Score: 7.8/10 (HIGH ...
show more
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes. Threat Score: 7.8/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
penjaga BRIN
2026-04-24 21:48:14
(1 month ago)
Web application attack
Web App Attack
🇮🇩
sockominfo
2026-04-24 03:00:37
(1 month ago)
Reported by TangerangKota-CSIRT. Status: MALICIOUS
Hacking
Brute-Force
🇮🇩
sockominfo
2026-04-24 02:00:14
(1 month ago)
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes. Threat Score: 7.8/10 (HIGH ...
show more
CRITICAL: Persistent attacker 208.84.101.148 - 10 attempts in 30 minutes. Threat Score: 7.8/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇮🇩
sockominfo
2026-04-24 01:00:38
(1 month ago)
TheHive Threat Scoring assessment: 208.84.101.148
CVSS v3.1: 0/10 (None)
CVSS Vector: CVSS:3.1/AV:un ...
show more
TheHive Threat Scoring assessment: 208.84.101.148
CVSS v3.1: 0/10 (None)
CVSS Vector: CVSS:3.1/AV:undefined/AC:undefined/PR:undefined/UI:undefined/S:undefined/C:undefined/I:undefined/A:undefined
Bayesian Probability: 80%
MITRE ATT&CK: Exploit Public-Facing Application, Valid Accounts, Command and Scripting Interpreter, Application Layer Protocol, Brute Force, Account Manipulation
OWASP Risk: High (L:8, I:6)
Combined Score: 4.92/10
Confidence Interval: ±0.01
Status: Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Brute-Force