🇩🇪
ghostwarriors
2026-11-06 05:50:06
UTC ·
(2 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-06 05:44:42
UTC ·
(2 hours ago)
35.185.229.157 - - [06/Nov/2026:06:44:38 +0100] "GET /....//....//....//..../.env HTTP/2.0" 301 66 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.a ...
show more
35.185.229.157 - - [06/Nov/2026:06:44:38 +0100] "GET /....//....//....//..../.env HTTP/2.0" 301 66 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
35.185.229.157 - - [06/Nov/2026:06:44:38 +0100] "POST /api/graphql HTTP/2.0" 404 42911 "https://[site]" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
35.185.229.157 - - [06/Nov/2026:06:44:39 +0100] "GET /?PageSpeed=noscript HTTP/2.0" 200 5489 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
35.185.229.157 - - [06/Nov/2026:06:44:39 +0100] "GET /.env%3Ffoo=bar HTTP/2.0" 403 297 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email])"
35.185.229.157 - - [06/Nov/2026:06:44:39 +0100] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP
show less
Web App Attack
Hacking
🇬🇧
consul.to
2026-11-06 05:13:26
UTC ·
(3 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
Hazzard
2026-11-06 03:48:30
UTC ·
(4 hours ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇹🇷
Jova
2026-11-06 03:17:41
UTC ·
(4 hours ago)
Requests impersonating 3 different crawlers from one IP.
Bad Web Bot
🇧🇾
lns.bz
2026-11-06 03:17:39
UTC ·
(4 hours ago)
.env scanning [BY]
Web App Attack
🇪🇸
el-brujo
2026-11-06 02:38:05
UTC ·
(5 hours ago)
06/Nov/2026:03:38:04.596432 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 35.185.229.157] ModSecurity: Warning. Pattern match "(?i)(?:\\\\\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2 ...
show more
06/Nov/2026:03:38:04.596432 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 35.185.229.157] ModSecurity: Warning. Pattern match "(?i)(?:\\\\\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "mail.elhacker.net"] [uri
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 02:02:38
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.185.229.157 (157.229.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:02:31.309065 2026] [security2:error] [pid 14644:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 35.185.229.157 (157.229.185.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:02:31.309065 2026] [security2:error] [pid 14644:tid 14644] [client 35.185.229.157:58998] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aupapierjaponais.com|F|2"] [data ".aupapierjaponais.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aupapierjaponais.com"] [uri "/z9x8c7v6b5-debug-trigger-www.aupapierjaponais.com"] [unique_id "au01N54C-BYvegfMFav7DQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-11-06 01:45:17
UTC ·
(6 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-06 01:17:44
UTC ·
(6 hours ago)
7.694 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇩🇪
Optimatiq (ThreatBite)
2026-11-06 00:49:17
UTC ·
(7 hours ago)
Probe for secrets or exploit paths (fail2ban)
Hacking
Web App Attack
🇩🇪
mondor.ro
2026-11-06 00:04:09
UTC ·
(8 hours ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 35.185.229.157, Reason:[(mod_security) mod_security (id:210832) triggered by 35.185.229.157 (US/United States/157.229.185.35.bc.googleusercontent.com): 3 in the last 3600 s ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 35.185.229.157, Reason:[(mod_security) mod_security (id:210832) triggered by 35.185.229.157 (US/United States/157.229.185.35.bc.googleusercontent.com): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
🇵🇱
wHosts
2026-11-06 00:03:53
UTC ·
(8 hours ago)
Blocked by Fail2Ban
Web App Attack
🇫🇷
regishoussin
2026-11-05 23:43:08
UTC ·
(8 hours ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-05 23:43 UTC.
Bad Web Bot
Web App Attack
🇨🇦
CentiDevOps
2026-11-05 23:37:46
UTC ·
(8 hours ago)
Web app scan: 699 requests in 12 s across 3 domains. Paths: /.git/config, /.env.keys, /docker-compose.yaml (+2 more).
Hacking
Web App Attack
