🇳🇱
WeCloudit-Anti-Abuse
2026-10-17 01:13:34
(17 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇨🇱
Fernando Soto
2026-10-17 01:05:01
(17 hours ago)
WAF propio vps1 (CL): sensMASx212 score 28 en 1h. sondeo rutas sensibles.
Web App Attack
🇩🇪
4server
2026-10-17 00:11:55
(18 hours ago)
[SatOct1702:11:50.5216982026][security2:error][pid1835231:tid1835363][client34.35.109.195:0]ModSecur ...
show more
[SatOct1702:11:50.5216982026][security2:error][pid1835231:tid1835363][client34.35.109.195:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"nobsarredamenti.ch.136-243-54-122.cpanel.site\"][uri\"/phpinfo.php.bak\"][unique_id\"atK9Rpn3jFbNlfz4FqKy-gAAARE\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 22:55:06
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 18:54:59.239647 2026] [security2:error] [pid 17823:tid 17836] [client 34.35.109.195:45690] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nobletitles.org"] [uri "/.git/config"] [unique_id "atKrQ9_Ku5NOuoZtefR3lAAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-16 22:53:35
(19 hours ago)
20 attempts against mh_ha-misbehave-ban on nobletest
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-16 22:02:11
(20 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-15.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-16 21:28:29
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:28:22.064959 2026] [security2:error] [pid 20172:tid 20185] [client 34.35.109.195:52062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nobledyn.com.briteh.com"] [uri "/.git/config"] [unique_id "atKW9rr3HKP3l5EkfftMCAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
maxxsense
2026-10-16 21:14:50
(21 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.35.109.195 (195.109.35.34.bc.googleu ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.35.109.195 (195.109.35.34.bc.googleusercontent.com)
show less
SQL Injection
🇸🇪
vaia.cloud
2026-10-16 18:50:01
(23 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-10-16 18:44:31
(23 hours ago)
110 requests with url.path *credentials.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-16 15:46:04
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 11:45:59.394175 2026] [security2:error] [pid 11709:tid 11709] [client 34.35.109.195:51714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "no1sicko.com"] [uri "/.git/config"] [unique_id "atJGt7TPDNK52Wq5TxDkdAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 11:21:34
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 07:21:26.674040 2026] [security2:error] [pid 14635:tid 14635] [client 34.35.109.195:56032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nnrentacar.com"] [uri "/.git/config"] [unique_id "atIItof6gg7yNtVFYtD5YwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
EmilGH
2026-10-16 10:40:09
(1 day ago)
34.35.109.195 - - [16/Oct/2026:10:40:00 +0000] "GET /.git/config HTTP/1.1" 403 589 "-" "Mozilla/5.0 ...
show more
34.35.109.195 - - [16/Oct/2026:10:40:00 +0000] "GET /.git/config HTTP/1.1" 403 589 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.35.109.195 - - [16/Oct/2026:10:40:00 +0000] "GET /.env HTTP/1.1" 403 589 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.35.109.195 - - [16/Oct/2026:10:40:00 +0000] "GET /.env.local HTTP/1.1" 403 589 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.35.109.195 - - [16/Oct/2026:10:40:01 +0000] "GET /.env.production HTTP/1.1" 403 589 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.35.109.195 - - [16/Oct/2026:10:40:01 +0000] "GET /.env.staging HTTP/1.1" 403 589 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-10-16 08:28:07
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 02:45:48
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.35.109.195 (195.109.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 22:45:45.857455 2026] [security2:error] [pid 7244:tid 7244] [client 34.35.109.195:56458] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nmrising.org.peterlundman.com"] [uri "/.git/config"] [unique_id "atGP2ZL5v59vovEL0mhumwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack