🇮🇳
evicky2002
2026-07-06 15:38:20
UTC ·
(4 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇭🇺
bcsaba
2026-05-19 01:45:48
UTC ·
(5 months ago)
Multiple firewall blocks events from same source.
May 19 03:45:47 firewall filterlog[98971]: 4,,,1000000103,*REDACTED*,match,block,in,4,0x0,,251,11779,0,none,6,tcp,40,35.185.190.81,*REDACTED*,55136,5001,0,S,2170429582,,1024,,
Port Scan
2026-05-15 16:31:45
UTC ·
(5 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
Blexyel
2026-05-15 16:13:22
UTC ·
(5 months ago)
35.185.190.81 - - [15/May/2026:01:19:53 +0200] "GET /.git/config HTTP/1.1" 200 2116 "-" "Mozilla/5.0 (Linux; Android 9; ASUS_X00TD) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 07:46:59
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:46:37.847022 2026] [security2:error] [pid 8937:tid 8 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:46:37.847022 2026] [security2:error] [pid 8937:tid 8937] [client 35.185.190.81:57734] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.scadainthecloud.motioncontrolpartners.com"] [uri "/.git/config"] [unique_id "agbPXcvXMRW7m6grDDzbjAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-05-15 07:35:36
UTC ·
(5 months ago)
[FriMay1509:35:30.0329792026][security2:error][pid3879959:tid3880194][client35.185.190.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"96072 ...
show more
[FriMay1509:35:30.0329792026][security2:error][pid3879959:tid3880194][client35.185.190.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"vanadhoc.ch.81-17-25-250.cpanel.site\"][uri\"/.git/config\"][unique_id\"agbMwm9_x5V09Hw8PsJOigAAAFg\"]
show less
Hacking
Web App Attack
2026-05-15 07:13:04
UTC ·
(5 months ago)
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1
Hacking
Web App Attack
🇫🇷
GoodOldTOS
2026-05-15 07:12:39
UTC ·
(5 months ago)
Bad keywords detected in request: /.git/config/.git
Web App Attack
🇷🇴
INTEQ
2026-05-15 06:36:15
UTC ·
(5 months ago)
Web attack from 35.185.190.81
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 06:26:23
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:26:14.850192 2026] [security2:error] [pid 3940:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:26:14.850192 2026] [security2:error] [pid 3940:tid 3940] [client 35.185.190.81:55106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.bnotlea.com"] [uri "/.git/config"] [unique_id "aga8ho2NM63rYytPvKUHjQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-05-15 06:08:02
UTC ·
(5 months ago)
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01,wa02]
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
CBJ
2026-05-15 04:43:56
UTC ·
(5 months ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 04:28:30
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 00:28:22.981841 2026] [security2:error] [pid 28958:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 00:28:22.981841 2026] [security2:error] [pid 28958:tid 28958] [client 35.185.190.81:58630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fireflypov.com"] [uri "/.git/config"] [unique_id "agag5gAp94IZhAdJAnaxbgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Antinson
2026-05-15 04:14:32
UTC ·
(5 months ago)
Scraping with a high error ratio and request rate Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-15 03:56:22
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 23:56:15.374709 2026] [security2:error] [pid 12979:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.185.190.81 (81.190.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 23:56:15.374709 2026] [security2:error] [pid 12979:tid 12979] [client 35.185.190.81:36932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smid.tv"] [uri "/.git/config"] [unique_id "agaZX9h1LP4Vd9TfPeA8TAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack