🇧🇷
SOC Blue Team
2026-01-16 17:48:48
(4 months ago)
Tatic: TA0006 | Technique: T1110 | Source: TAP | Country Destination: BR
Brute-Force
🇺🇸
TPI-Abuse
2025-12-27 20:15:29
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 15:15:20.606708 2025] [security2:error] [pid 5087:tid 5087] [client 45.3.40.182:47255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cosplayculture.com"] [uri "/.git/HEAD"] [unique_id "aVA-WEtYNgXuJLza_G61FwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 18:16:54
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 13:16:46.448390 2025] [security2:error] [pid 31734:tid 31734] [client 45.3.40.182:36155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "left-hander.com"] [uri "/.svn/wc.db"] [unique_id "aVAijtLzl7i_ZdJLvR3WSgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-26 13:16:44
(5 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 06:38:47
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 01:38:43.292681 2025] [security2:error] [pid 16825:tid 16897] [client 45.3.40.182:39821] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.alabamacentralrailroad.com"] [uri "/.env"] [unique_id "aSagc4pGi0qyZ6NgFD3JegAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 01:39:41
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:39:38.051164 2025] [security2:error] [pid 25812:tid 25812] [client 45.3.40.182:51141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.gbcwoodbine.org"] [uri "/.svn/wc.db"] [unique_id "aSZaWovbelKMYohDeFVanQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2025-11-25 22:37:38
(6 months ago)
Attempted access to sensitive endpoint (/.git/HEAD) detected. Automated scan or unauthorized probing ...
show more
Attempted access to sensitive endpoint (/.git/HEAD) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 06:22:40
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:22:31.902236 2025] [security2:error] [pid 24465:tid 24465] [client 45.3.40.182:28261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.astrology7.com"] [uri "/.git/HEAD"] [unique_id "aSVLJ7mnGjOrMgrB7TQtZQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:55:58
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:55:52.111309 2025] [security2:error] [pid 32747:tid 32747] [client 45.3.40.182:36813] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.calypsodirect.com"] [uri "/.svn/wc.db"] [unique_id "aSVE6LUaXvevRggoKDXs0gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:39:08
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:39:05.281117 2025] [security2:error] [pid 16494:tid 16494] [client 45.3.40.182:59635] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.johnhansonmemorial.org"] [uri "/.svn/wc.db"] [unique_id "aSVA-T48BdLbrjsJCcn_MwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:02:11
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:02:08.498550 2025] [security2:error] [pid 14226:tid 14314] [client 45.3.40.182:45153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.chadzone.com"] [uri "/.env"] [unique_id "aSU4UJF6HRvJfyrmJlm1YAAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:22:59
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:22:54.283669 2025] [security2:error] [pid 11391:tid 11391] [client 45.3.40.182:23309] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.thecalls.net"] [uri "/.env"] [unique_id "aSUhDo39ZwLEnliXOhl8mgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 01:47:50
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:47:43.763804 2025] [security2:error] [pid 30972:tid 30972] [client 45.3.40.182:38301] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.milajarecords.com"] [uri "/.git/HEAD"] [unique_id "aSUKv_a7LB52y8x_iCqTswAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 01:11:32
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:11:27.088232 2025] [security2:error] [pid 2454:tid 2454] [client 45.3.40.182:24903] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.partyblockbaby.com"] [uri "/.env"] [unique_id "aSUCP9vh_yZTBxxKiBkIkAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 00:53:37
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.40.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:53:29.451354 2025] [security2:error] [pid 15300:tid 15300] [client 45.3.40.182:54721] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.argentinas.com"] [uri "/.git/HEAD"] [unique_id "aST-CQTxTnO4uKSZbU_BKQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack