🇺🇸
TPI-Abuse
2026-09-30 10:39:41
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 168.144.35.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 168.144.35.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:39:36.894039 2026] [security2:error] [pid 18625:tid 18625] [client 168.144.35.113:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wyndover.photo"] [uri "/.env.dist"] [unique_id "arzm6Gfu9tW3RMYtt1awnQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-30 08:57:26
(3 weeks ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack
🇫🇷
pm33
2026-09-29 21:29:26
(3 weeks ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇸🇬
simpeg-adm.bandung.go.id
2026-09-28 06:29:22
(3 weeks ago)
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/.git/HEAD?"
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/ ...
show more
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/.git/HEAD?"
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/.env.local?"
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/.aws/credentials?"
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/secrets.json?"
28/Sep/2026:06:29:19 +0000;168.144.35.113;"/.env.backup?"
28/Sep/2026:06:29:20 +0000;168.144.35.113;"/.git/HEAD?"
28/Sep/2026:06:29:22 +0000;168.144.35.113;"/.env.test?"
...
show less
Web Spam
Brute-Force
Web App Attack
2026-09-26 03:16:39
(4 weeks ago)
GET /.git/config HTTP/1.1
...
Web App Attack
2026-09-25 16:59:08
(4 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇨🇭
backslash
2026-09-24 11:12:02
(1 month ago)
block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638
Bad Web Bot
🇩🇪
ger-stg-sifi1
2026-09-24 09:10:22
(1 month ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇯🇵
Kinsei Engineering Inc.
2026-09-21 11:49:23
(1 month ago)
2026/09/21 20:49:20 [error] 81031#81031: *18603 access forbidden by rule, client: 168.144.35.113, se ...
show more
2026/09/21 20:49:20 [error] 81031#81031: *18603 access forbidden by rule, client: 168.144.35.113, server: www.kinsei.jp, request: "GET /.env.test HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/.env.test"
2026/09/21 20:49:22 [error] 81032#81032: *18606 access forbidden by rule, client: 168.144.35.113, server: www.kinsei.jp, request: "GET /.env.old HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/.env.old"
2026/09/21 20:49:22 [error] 81032#81032: *18610 access forbidden by rule, client: 168.144.35.113, server: www.kinsei.jp, request: "GET /.env.sample HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/.env.sample"
show less
Brute-Force
Web Spam
🇳🇱
Alt255
2026-09-21 07:25:52
(1 month ago)
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Examp ...
show more
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 168.144.35.113 - - [21/Sep/2026:09:25:41 +0200] "GET /.git/HEAD HTTP/1.1" 404 7860 "https://lucasstar6929.peterhillen.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fhuipen.bdaconnect.nl%2F.git%2FHEAD" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
WPJoe
2026-09-20 15:19:12
(1 month ago)
168.144.35.113 - - [20/Sep/2026:15:19:11 +0000] "GET /.env.local HTTP/1.1" 403 4362 "https://weather ...
show more
168.144.35.113 - - [20/Sep/2026:15:19:11 +0000] "GET /.env.local HTTP/1.1" 403 4362 "https://weathered-pine-feca.0kyev7ny.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fbuild.c2cnd.org%2F.env.local" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
168.144.35.113 - - [20/Sep/2026:15:19:12 +0000] "GET /.git/config HTTP/1.1" 403 4364 "https://worker-holy-fog-ee67.chaukaho.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fbuild.c2cnd.org%2F.git%2Fconfig" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
...
show less
Web App Attack
Bad Web Bot
🇳🇱
Alt255
2026-09-18 09:05:25
(1 month ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 168.144.35.113 - - [18/Sep/2026:11:05:17 +0200] "GET /.env HTTP/2.0" 301 434 "https://www.google.com/search?q=www.90sixdesign.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-17 06:56:08
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-10 22:04:01
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-09.
show less
Web App Attack
SSH
Hacking
🇳🇱
homeshowdomain.nl
2026-09-09 21:59:08
(1 month ago)
Auto-ban: >3000 req/min op 2026-09-09
Web App Attack
SSH
Hacking
