🇫🇷
Derek Linz
2026-10-02 16:49:24
(3 weeks ago)
Automated: web scanner probing exploit paths: /.env.save, /static/home/user/.env, /.env.bak, /@fs/ap ...
show more
Automated: web scanner probing exploit paths: /.env.save, /static/home/user/.env, /.env.bak, /@fs/app/.env?raw??, /config/.env
show less
Port Scan
Web App Attack
🇩🇪
klaus_ph
2026-09-27 07:34:47
(4 weeks ago)
2026-09-26 03:05:05,159 fail2ban.actions [594716]: NOTICE [ipblocklist] Ban 35.194.167.179
. ...
show more
2026-09-26 03:05:05,159 fail2ban.actions [594716]: NOTICE [ipblocklist] Ban 35.194.167.179
...
show less
Bad Web Bot
🇲🇽
octageeks.com
2026-09-23 04:22:37
(1 month ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
ambor
2026-09-23 01:55:04
(1 month ago)
Honeypot triggered: /backend/.env on ifebridge.com. User-Agent: Mozilla/5.0 (compatible; YouBot/1.0; ...
show more
Honeypot triggered: /backend/.env on ifebridge.com. User-Agent: Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot). Method: GET
show less
Web App Attack
🇳🇱
ConsulHosting
2026-09-23 01:41:42
(1 month ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇸🇬
Cloudkul Cloudkul
2026-09-23 00:54:27
(1 month ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
🇩🇪
Skyrider
2026-09-22 19:09:36
(1 month ago)
Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.
Bad Web Bot
Web App Attack
2026-09-22 18:44:31
(1 month ago)
Automatically blocked after 42 security events. Observed sensitive configuration-file probes. Source ...
show more
Automatically blocked after 42 security events. Observed sensitive configuration-file probes. Source: Cloudflare security controls.
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:24:37
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:24:32.559662 2026] [security2:error] [pid 6379:tid 6379] [client 35.194.167.179:58528] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hardcountryrock.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hardcountryrock.com"] [uri "/z9x8c7v6b5-debug-trigger-hardcountryrock.com"] [unique_id "arLH4EufcaIJ7KbxtXkClQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-09-22 17:54:49
(1 month ago)
Honeypot triggered: /storage/.env on ifebridge.com. User-Agent: Mozilla/5.0 (compatible; Bytespider; ...
show more
Honeypot triggered: /storage/.env on ifebridge.com. User-Agent: Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36. Method: GET
show less
Web App Attack
🇳🇴
Bots.go.to.hell
2026-09-22 17:31:50
(1 month ago)
This IP was detected by CrowdSec triggering custom/http-bad-crawler-ban
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-22 16:43:50
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:43:47.248340 2026] [security2:error] [pid 12127:tid 12127] [client 35.194.167.179:57594] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lifeinsmoke.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lifeinsmoke.com"] [uri "/z9x8c7v6b5-debug-trigger-lifeinsmoke.com"] [unique_id "arKwQ8-B_9gwJkXJxSrnfwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:22:15
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:22:06.669618 2026] [security2:error] [pid 9619:tid 9619] [client 35.194.167.179:38526] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lifestylemedica.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lifestylemedica.com"] [uri "/z9x8c7v6b5-debug-trigger-lifestylemedica.com"] [unique_id "arKrLves8c5ldg2vVO1lfQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:23:07
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:949110) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:23:01.781937 2026] [security2:error] [pid 12136:tid 12136] [client 35.194.167.179:44574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "likulikubookings.com"] [uri "/z9x8c7v6b5-debug-trigger-likulikubookings.com"] [unique_id "arKdVTPf6xZNTCG8LytTiwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 14:39:10
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.194.167.179 (179.167.194.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 10:39:06.684747 2026] [security2:error] [pid 25987:tid 25987] [client 35.194.167.179:51996] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||limosnapa.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "limosnapa.com"] [uri "/z9x8c7v6b5-debug-trigger-limosnapa.com"] [unique_id "arKTCuAkJKF2RftPuvRUDAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
