🇺🇸
TPI-Abuse
2026-11-04 00:51:45
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:51:38.424485 2026] [security2:error] [pid 6653:tid 6 ...
show more
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:51:38.424485 2026] [security2:error] [pid 6653:tid 6653] [client 8.231.103.132:53506] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "justkoolit.com"] [uri "/.git/config"] [unique_id "auqBmuWqDMy0okTGhynhUQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 00:01:11
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:01:01.154561 2026] [security2:error] [pid 11765:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:01:01.154561 2026] [security2:error] [pid 11765:tid 11765] [client 8.231.103.132:55652] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "justjunglejuice.org"] [uri "/.git/config"] [unique_id "aup1vV9gyqQ7XGFk45KNxwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 18:29:04
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 13:28:57.776450 2026] [security2:error] [pid 24690:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 13:28:57.776450 2026] [security2:error] [pid 24690:tid 24690] [client 8.231.103.132:38650] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "justinrudd.com"] [uri "/.git/config"] [unique_id "auon6T2BDjtyVUFTkNZCGAAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 17:55:08
UTC ·
(5 days ago)
(mod_security) mod_security (id:949110) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 12:55:01.620076 2026] [security2:error] [pid 22422:tid ...
show more
(mod_security) mod_security (id:949110) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 12:55:01.620076 2026] [security2:error] [pid 22422:tid 22422] [client 8.231.103.132:53326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "justinpenney.com"] [uri "/.git/config"] [unique_id "auof9ZLI-qp2hNGVjlsGlgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Justin Goetz
2026-11-03 14:34:17
UTC ·
(5 days ago)
Probed /.env, /.env.backup, /.env.bak, /.env.ci, /.env.dev
Web App Attack
🇸🇪
vaia.cloud
2026-11-03 13:10:04
UTC ·
(5 days ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-11-03 09:05:03
UTC ·
(5 days ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-03 06:16:10
UTC ·
(5 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 00:16:38
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 19:16:34.871535 2026] [security2:error] [pid 28591:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 19:16:34.871535 2026] [security2:error] [pid 28591:tid 28609] [client 8.231.103.132:39602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kimbleproperties.com"] [uri "/.git/config"] [unique_id "aukn4vVckv98ECTBxYTJhgAAAFA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
grassyloki
2026-11-02 21:34:00
UTC ·
(6 days ago)
Enumerated phpinfo and .env secret-file paths on the kimberlymackdesignstudio.com vhost in a ~15s burst, all requests returned 403/404.
Target: HTTP 80, kimberlymackdesignstudio.com vhost (/phpinfo variants and /.env secret-file paths)
Seen: 2026-11- ...
show more
Enumerated phpinfo and .env secret-file paths on the kimberlymackdesignstudio.com vhost in a ~15s burst, all requests returned 403/404.
Target: HTTP 80, kimberlymackdesignstudio.com vhost (/phpinfo variants and /.env secret-file paths)
Seen: 2026-11-02 16:34 EST
- 16:34:44 GET /server-info.php 404 on kimberlymackdesignstudio.com vhost
- 16:34:41 GET /phpinfo 404 and 16:34:43 GET /debug.php 404
- 16:34:37 GET /sparkpost/.env 403 and 16:34:29 GET /next/.env 403 (secret-file enumeration)
- 16:34:25 GET /.env.example 403 and 16:34:45 GET /_environment 404
- ~167 requests in the hour, all 403/404, UA Chrome/131
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:43:35
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:43:31.616531 2026] [security2:error] [pid 17618:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 8.231.103.132 (132.103.231.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:43:31.616531 2026] [security2:error] [pid 17618:tid 17618] [client 8.231.103.132:37526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kh6jim.com"] [uri "/.git/config"] [unique_id "auh3Y_04jrOUfXBe-xMGnwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
