🇮🇱
spd.co.il
2026-09-18 18:02:18
(1 month ago)
Web application attack detected
Hacking
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-17 22:19:41
(1 month ago)
Brute-Force
Web App Attack
🇺🇸
EvilTurkey
2026-09-17 14:55:40
(1 month ago)
Web app attack against financial institution website.
Web App Attack
Hacking
🇧🇪
Ivo Vynckier
2026-09-17 14:49:00
(1 month ago)
3.236.228.127 - - [17/Sep/2026:01:02:35 +0200] "GET /rclone.conf HTTP/2.0" 404 2143 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
3.236.228.127 - - [17/Sep/2026:01:02:35 +0200] "GET /service-account.json HTTP/2.0" 404 2143 "-" "Mozi ...
show more
3.236.228.127 - - [17/Sep/2026:01:02:35 +0200] "GET /rclone.conf HTTP/2.0" 404 2143 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
3.236.228.127 - - [17/Sep/2026:01:02:35 +0200] "GET /service-account.json HTTP/2.0" 404 2143 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
3.236.228.127 - - [17/Sep/2026:01:02:35 +0200] "GET /z9x8c7v6b5-debug-trigger-how-ocr-works.com HTTP/2.0" 404 2143 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
3.236.228.127 - - [17/Sep/2026:01:02:35 +0200] "GET /credentials.json HTTP/2.0" 404 2143 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
show less
Web App Attack
🇮🇳
evicky2002
2026-09-17 06:00:05
(1 month ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇧🇪
taivas.nl
2026-09-17 04:34:02
(1 month ago)
Many_bad_calls
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 02:07:36
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 3.236.228.127 (ec2-3-236-228-127.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:07:31.219498 2026] [security2:error] [pid 9922:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 3.236.228.127 (ec2-3-236-228-127.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:07:31.219498 2026] [security2:error] [pid 9922:tid 9922] [client 3.236.228.127:54468] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||n3fjp.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "n3fjp.com"] [uri "/rclone.conf"] [unique_id "aqtLY3I1A1v601difPSCiwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
MyGlobalFlowers
2026-09-17 02:04:09
(1 month ago)
Multiple WAF Violations
Web App Attack
🇺🇸
cwytech
2026-09-17 01:21:40
(1 month ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-probing.
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-09-17 01:17:00
(1 month ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 3.236.228.127 (US/United States/ec2-3-236-228-127.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 3.236.228.127 - - [17/Sep/20 ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 3.236.228.127 (US/United States/ec2-3-236-228-127.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 3.236.228.127 - - [17/Sep/2026:03:16:54 +0200] "GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/2.0" 429 41 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" "3.236.228.127" host=masterlabvideoproduzioni.it
show less
Port Scan
🇮🇪
RoboSOC
2026-09-17 01:16:26
(1 month ago)
Langflow Unauthenticated Remote Code Execution Vulnerability, PTR: ec2-3-236-228-127.compute-1.amazonaws.com.
Hacking
🇺🇸
TPI-Abuse
2026-09-17 01:15:13
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 3.236.228.127 (ec2-3-236-228-127.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 21:15:05.520875 2026] [security2:error] [pid 25824:t ...
show more
(mod_security) mod_security (id:210730) triggered by 3.236.228.127 (ec2-3-236-228-127.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 21:15:05.520875 2026] [security2:error] [pid 25824:tid 25824] [client 3.236.228.127:51030] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||marxistphilosophy.org|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "marxistphilosophy.org"] [uri "/rclone.conf"] [unique_id "aqs_GYezPY4HYEtj6CMVHQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Mundo Bueno
2026-09-17 01:02:06
(1 month ago)
[ISILIA Protection v2.1] Tentative d'accès: /.git-credentials | Pays: US | UA: Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)
Hacking
Web App Attack
🇨🇦
Mediashaker
2026-09-17 00:50:51
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 3.236.228.127 (US/United States/ec2-3-236-228-127.compute-1.amazonaws.com)
Bad Web Bot
🇬🇧
Apache
2026-09-17 00:44:08
(1 month ago)
(mod_security) mod_security (id:911100) triggered by 3.236.228.127 (US/United States/ec2-3-236-228-127.compute-1.amazonaws.com): 5 in the last 300 secs (CF_ENABLE)
Brute-Force
Web App Attack
