🇩🇪
raph
2026-06-19 19:10:30
(23 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-06-07 21:10:31
(1 week ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
2026-05-08 09:59:08
(1 month ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇩🇪
4server
2026-04-21 16:47:05
(1 month ago)
[TueApr2118:46:59.2324802026][security2:error][pid3025242:tid3025335][client209.50.182.49:0]ModSecur ...
show more
[TueApr2118:46:59.2324802026][security2:error][pid3025242:tid3025335][client209.50.182.49:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"grigorov.ch\"][uri\"/database.sql\"][unique_id\"aeeqA0odPrcZ1V_bs78x9AAAANE\"]
show less
Port Scan
Brute-Force
Web App Attack
2026-04-18 22:22:19
(2 months ago)
"GET http://<domain>.com/dump.sql HTTP/1.1"
Hacking
Web App Attack
2026-01-05 20:24:13
(5 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.05 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.05 is noted in report timestamp
show less
Hacking
Brute-Force
🇧🇪
madeit
2025-11-27 12:13:24
(6 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 05:24:22
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 00:24:16.578235 2025] [security2:error] [pid 32533:tid 32533] [client 209.50.182.49:35145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.tankercontrol.com"] [uri "/.svn/wc.db"] [unique_id "aSaPAP4pU6Hy5VwWnUVsSQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 03:07:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 22:07:40.216518 2025] [security2:error] [pid 3278:tid 3278] [client 209.50.182.49:14539] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.grantjennings.com"] [uri "/.git/HEAD"] [unique_id "aSZu_GZ4dShP8lQeOZYgZgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 08:48:09
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:48:02.840335 2025] [security2:error] [pid 20881:tid 20881] [client 209.50.182.49:17035] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.monmouthbottleshop.com"] [uri "/.svn/wc.db"] [unique_id "aSQbwkVt80gjdNB_6Vwq-QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:45:56
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:45:45.770947 2025] [security2:error] [pid 12831:tid 12831] [client 209.50.182.49:50233] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.peradotto.net"] [uri "/.git/HEAD"] [unique_id "aSPxCUEg8vmv9wlJugC9dAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 02:13:04
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.182.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 21:12:59.558558 2025] [security2:error] [pid 2893:tid 2905] [client 209.50.182.49:31589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.idwic.com"] [uri "/.svn/wc.db"] [unique_id "aSO_KyZWVzJkk5khHgNOvgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-22 11:50:53
(6 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
2025-11-21 18:24:20
(6 months ago)
This IP was involved in an brute force and password spray attack on 2025/11/21 12:19:52
Port Scan
Brute-Force
Exploited Host
Web App Attack
🇺🇸
Rip
2025-11-02 10:15:05
(7 months ago)
Authentication attack attempt. CMS Brute Force - Access Forbidden
Brute-Force
Web App Attack