🇺🇸
TPI-Abuse
2026-10-26 11:29:26
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 52.41.104.222 (ec2-52-41-104-222.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:29:19.837506 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 52.41.104.222 (ec2-52-41-104-222.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:29:19.837506 2026] [security2:error] [pid 11376:tid 11383] [client 52.41.104.222:47966] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "richardleeweatherman.com"] [uri "/.git/config"] [unique_id "at85jwpcqXgVSNtnprvFNgAAAQE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-10-26 11:20:10
UTC ·
(2 weeks ago)
Web App Attack
🇮🇹
VHosting
2026-10-26 11:15:04
UTC ·
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
ams_sec_user
2026-10-26 11:05:20
UTC ·
(2 weeks ago)
Automated requests against a hosted website: 43 requests between 10:00 and 10:59 UTC; 25 probes for exposed secrets/config files (/.git/config, /.git/HEAD, /.git/COMMIT_EDITMSG). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
🇫🇷
cityhunter_rhone
2026-10-26 11:04:02
UTC ·
(2 weeks ago)
Observed at (UTC): 2026-10-26T11:02:37+00:00 | Mercurius Guide auto detection | source=Fail2Ban | scraper score=8 | events=4 | decision=datacenter | actions=fingerprint_visit, os_obsolete_block, os_unknown_block APACHE_DENIED_AGGREGATE | last_seen=20 ...
show more
Observed at (UTC): 2026-10-26T11:02:37+00:00 | Mercurius Guide auto detection | source=Fail2Ban | scraper score=8 | events=4 | decision=datacenter | actions=fingerprint_visit, os_obsolete_block, os_unknown_block APACHE_DENIED_AGGREGATE | last_seen=2026-10-26 12:02:37
show less
Bad Web Bot
Web App Attack
🇺🇸
ruusvuu
2026-10-26 10:51:26
UTC ·
(2 weeks ago)
Automated abuse report: 25 attack/probe requests from Amazon.com, Inc. / US.
Targeted paths: /core/install.php, /docker-compose.yml, /docker-compose.yaml, /docker-compose.prod.yml, /docker-compose.production.yml.
Sample log lines:
[mir-com] [10/26/20 ...
show more
Automated abuse report: 25 attack/probe requests from Amazon.com, Inc. / US.
Targeted paths: /core/install.php, /docker-compose.yml, /docker-compose.yaml, /docker-compose.prod.yml, /docker-compose.production.yml.
Sample log lines:
[mir-com] [10/26/2026, 3:51:26 AM] GET .mirregistry.com/.env.production 429 52.41.104.222 - 5.051 ms
[mir-com] [10/26/2026, 3:51:26 AM] GET .mirregistry.com/.env.development 429 52.41.104.222 - 6.824 ms
[mir-com] [10/26/2026, 3:51:26 AM] GET .mirregistry.com/.env.development 429 52.41.104.222 - 6.824 ms
Detected by an automated web-server log monitor.
show less
Web App Attack
🇳🇿
realstuffie
2026-10-26 10:49:12
UTC ·
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
kkwemi
2026-10-26 10:40:00
UTC ·
(2 weeks ago)
Blocked by block-exploit-paths on /.env
Bad Web Bot
🇺🇸
Actors.Bible
2026-10-26 10:38:11
UTC ·
(2 weeks ago)
Webapp Vulnerability Probing:
GET /core/install.php
GET /administrator/manifests/files/joomla.xml
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 10:20:54
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 52.41.104.222 (ec2-52-41-104-222.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 06:20:49.852430 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 52.41.104.222 (ec2-52-41-104-222.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 06:20:49.852430 2026] [security2:error] [pid 28972:tid 28972] [client 52.41.104.222:50682] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.daveslawncare.com"] [uri "/.git/config"] [unique_id "at8pgWEkWLOm5eaHy6sZhAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-26 10:05:32
UTC ·
(2 weeks ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
