🇺🇸
TPI-Abuse
2026-11-03 13:14:57
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 68.183.101.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 08:14:53.144296 2026] [security2:error] [pid 13699:tid 13699] [client 68.183.101.74:49298] M ...
show more
(mod_security) mod_security (id:210492) triggered by 68.183.101.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 08:14:53.144296 2026] [security2:error] [pid 13699:tid 13699] [client 68.183.101.74:49298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.198"] [uri "/.git/config"] [unique_id "auneTXTXBP4WdGAGAOLGMgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-03 13:13:30
UTC ·
(4 days ago)
68.183.101.74 - - [03/Nov/2026:13:13:28 +0000] "GET /.git/config HTTP/1.1" 301 17 "-" "-" 917713 "http-catchall@file" "-" 0ms
68.183.101.74 - - [03/Nov/2026:13:13:29 +0000] "GET /.git/config HTTP/1.1" 404 19 "-" "-" 917714 "-" "-" 0ms
...
Web App Attack
🇸🇮
satelliteproxy
2026-11-03 13:07:38
UTC ·
(4 days ago)
DPI (Deep Packet Inspection) identified this source as an abusive automated web bot.
Bad Web Bot
🇷🇺
weke
2026-11-03 13:01:37
UTC ·
(4 days ago)
Low-interaction honeypot observation; observed_at=2026-11-03T13:01:37.016Z; window_ms=10005; connections=2; traffic=756B-in/181B-out; destinations=80/http:1c,239B-in,181B-out | 443/tls-clienthello:1c,517B-in,0B-out; protocols=http,tls-clienthello; ca ...
show more
Low-interaction honeypot observation; observed_at=2026-11-03T13:01:37.016Z; window_ms=10005; connections=2; traffic=756B-in/181B-out; destinations=80/http:1c,239B-in,181B-out | 443/tls-clienthello:1c,517B-in,0B-out; protocols=http,tls-clienthello; categories=21; indicators=secret-file-probe; http=GET /.git/config [ua=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36]; tls=alpn=http/1.1,ja3=f80d3d09f61892c5846c854dd84ac403,versions=0x0304,0x0303
show less
Web App Attack
🇩🇪
altenglaner
2026-11-03 12:56:00
UTC ·
(4 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇫🇷
security.rdmc.fr
2026-11-03 12:52:41
UTC ·
(4 days ago)
Web scan: request for a sensitive file (.env, .git, wp-config...)
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-03 12:51:59
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 68.183.101.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:51:54.765672 2026] [security2:error] [pid 26968:tid 26968] [client 68.183.101.74:51180] M ...
show more
(mod_security) mod_security (id:210492) triggered by 68.183.101.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:51:54.765672 2026] [security2:error] [pid 26968:tid 26968] [client 68.183.101.74:51180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.12"] [uri "/.git/config"] [unique_id "aunY6lWexOPWu9addx12JQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
MyGlobalFlowers
2026-11-03 12:48:59
UTC ·
(4 days ago)
Multiple WAF Violations
Web App Attack
🇨🇳
PrivateLiu
2026-11-03 12:48:02
UTC ·
(4 days ago)
[AbuseIPDB auto-report] Rules: Rule5. Region: non-CN. Known vulnerability path probing: targeting CMS (WordPress/Drupal), phpMyAdmin, actuator endpoints, or other known vulnerable paths. Sample paths: /.git/config. Statuses: 301, 404. Methods: GET. U ...
show more
[AbuseIPDB auto-report] Rules: Rule5. Region: non-CN. Known vulnerability path probing: targeting CMS (WordPress/Drupal), phpMyAdmin, actuator endpoints, or other known vulnerable paths. Sample paths: /.git/config. Statuses: 301, 404. Methods: GET. UA: N/A
show less
Web App Attack
🇳🇱
wlt-blocker
2026-11-03 12:45:56
UTC ·
(4 days ago)
Unauthorized access to webpage admin
Web App Attack
🇳🇴
jad-abuse
2026-11-03 12:40:22
UTC ·
(4 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure. Observed by 1 sensor(s); 1 hits.
Web App Attack
🇺🇸
Blamdom
2026-11-03 12:39:42
UTC ·
(4 days ago)
Secret/config-file recon: requested /.git/config. 2 HTTP request(s), 2026-11-03 12:39:42 to 12:39:43 UTC (1s).
Requests (method path -> status xcount):
GET /.git/config -> 301 x2
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G ...
show more
Secret/config-file recon: requested /.git/config. 2 HTTP request(s), 2026-11-03 12:39:42 to 12:39:43 UTC (1s).
Requests (method path -> status xcount):
GET /.git/config -> 301 x2
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
Klompenzijncool
2026-11-03 12:34:53
UTC ·
(4 days ago)
Web scanning/probing blocked by Fail2Ban.
Port Scan
Bad Web Bot
🇳🇱
Starburst SysOp Team
2026-11-03 12:31:39
UTC ·
(4 days ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-ams6-1)
Hacking
Bad Web Bot
🇬🇧
Smish
2026-11-03 12:30:32
UTC ·
(4 days ago)
HONEYPOT HIT --> Fail2ban time=1793709031 log=2026-11-03T12:30:31+00:00 ip=68.183.101.74 host=89.39.211.7 method=GET uri="/.git/config" status=404 ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/ ...
show more
HONEYPOT HIT --> Fail2ban time=1793709031 log=2026-11-03T12:30:31+00:00 ip=68.183.101.74 host=89.39.211.7 method=GET uri="/.git/config" status=404 ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ref="-" rid=80ccb0aa1c5db58c6066be856926a6af
show less
Web App Attack
