🇧🇷
SOC PR
2026-06-03 06:14:21
(3 days ago)
IPS: Sensitive Configuration File Disclosure.
Hacking
🇺🇸
TPI-Abuse
2026-06-03 05:31:16
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 01:31:12.274339 2026] [security2:error] [pid 18266:tid 18291] [client 135.232.211.210:61335] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.44"] [uri "/.git/config"] [unique_id "ah-8IOQyR2rJJ3CbcdEmrgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
PeravixGroup
2026-06-02 14:26:03
(4 days ago)
Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ...
show more
Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud
show less
Port Scan
Bad Web Bot
🇺🇸
ISPLtd
2026-06-02 07:47:22
(4 days ago)
Jun 2 04:47:10 135.232.211.210 TCP SPT=36770 DPT=2087 SYN
Jun 2 04:47:10 135.232.211.210 TCP SPT=3 ...
show more
Jun 2 04:47:10 135.232.211.210 TCP SPT=36770 DPT=2087 SYN
Jun 2 04:47:10 135.232.211.210 TCP SPT=36762 DPT=2082 SYN
Jun 2 04:47:10 135.232.211.210 TCP SPT=36743 DPT=2083
...
show less
Port Scan
🇫🇷
Hiigara
2026-06-02 06:31:02
(4 days ago)
connection attempt : 135.232.211.210 on port : tcp/8080 (HTTP-alt)
Port Scan
🇺🇸
TPI-Abuse
2026-06-02 06:20:12
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 02:20:07.641590 2026] [security2:error] [pid 19705:tid 19705] [client 135.232.211.210:37762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.236"] [uri "/.env.production"] [unique_id "ah52F15W3Lz_WHB4_ocBjAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
tpjg
2026-06-02 05:02:02
(4 days ago)
Automated: 15 requests with error status in 120s window from 135.232.211.210.
Evidence: /backup.sql: ...
show more
Automated: 15 requests with error status in 120s window from 135.232.211.210.
Evidence: /backup.sql:301,/config.php:301,/.DS_Store:301,/actuator/env:301,/server-status:301,/phpinfo.php:301,/config/database.yml:301,/.aws/credentials:301,/wp-config.php.bak:301,/.env.save:301,/.env.production:301,/.env.local:301,/.env:301,/.git/config:301,/.git/HEAD:301
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 04:58:18
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:58:14.761575 2026] [security2:error] [pid 19556:tid 19556] [client 135.232.211.210:37281] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.199"] [uri "/.git/HEAD"] [unique_id "ah5i5tCZuc5Hmh0hwdsE_QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
guillaume illien
2026-06-02 04:51:31
(4 days ago)
135.232.211.210 - - [02/Jun/2026:04:51:20 +0000] "GET /.git/HEAD HTTP/1.1" 301 178 "-" "Mozilla/5.0 ...
show more
135.232.211.210 - - [02/Jun/2026:04:51:20 +0000] "GET /.git/HEAD HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
135.232.211.210 - - [02/Jun/2026:04:51:24 +0000] "GET /.env.local HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
135.232.211.210 - - [02/Jun/2026:04:51:25 +0000] "GET /.env.production HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
135.232.211.210 - - [02/Jun/2026:04:51:27 +0000] "GET /.env.backup HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
135.232.211.210 - - [02/Jun/2026:04:51:28 +0000] "GET /.env.save HTTP/1.1" 301 178 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
135.232.211.210 - - [02/Jun/2026:04:51:29 +000
...
show less
Hacking
Brute-Force
Web App Attack
SSH
🇺🇸
TPI-Abuse
2026-06-02 04:06:08
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 135.232.211.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:06:01.314506 2026] [security2:error] [pid 29727:tid 29727] [client 135.232.211.210:37258] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.154"] [uri "/.env"] [unique_id "ah5WqemdCvWU4pvSzzJNjQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack