🇧🇷
dermatovirtual
2026-10-12 10:06:38
(5 days ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 133 unauthorized requests recorded between 2026-10-11 10:03:07 UTC and 2026-10-11 10:03:17 UTC (rate: ~133 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-10-11 10:03:17 UTC] IP: 35.187.90.69 - W3C IIS (Port 443): GET /images../.env -> HTTP 404 [CLIENT: 35.187.90.69]
[2026-10-11 10:03:17 UTC] IP: 35.187.90.69 - W3C IIS (Port 443): GET /files../.env -> HTTP 404 [CLIENT: 35.187.90.69]
[2026-10-11 10:03:17 UTC] IP: 35.187.90.69 - W3C IIS (Port 443): GET /css../.env -> HTTP 404 [CLIENT: 35.187.90.69]
show less
Bad Web Bot
Web App Attack
🇨🇭
🇨🇭 Hosting
2026-10-12 05:10:27
(5 days ago)
Automated WAF report: 100-125 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
🇨🇱
Fernando Soto
2026-10-12 03:05:23
(5 days ago)
WAF propio vps1 (CL): sensMASx129 score 30 en 1h. sondeo rutas sensibles.
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-11 22:02:32
(5 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-10.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-11 14:02:09
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 35.187.90.69 (69.90.187.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.187.90.69 (69.90.187.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 10:02:02.825377 2026] [security2:error] [pid 19336:tid 19336] [client 35.187.90.69:54932] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||app.oxfordgliding.com|F|2"] [data ".oxfordgliding.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "app.oxfordgliding.com"] [uri "/z9x8c7v6b5-debug-trigger-app.oxfordgliding.com"] [unique_id "asuW2lxdkfAhXH3-K_MvNQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-10-11 13:29:15
(6 days ago)
fail2ban-ban
Hacking
Brute-Force
Exploited Host
Web App Attack
🇧🇾
lns.bz
2026-10-11 11:50:54
(6 days ago)
.env scanning [BY]
Web App Attack
🇩🇪
Fahreddin Ergin
2026-10-11 11:44:03
(6 days ago)
Detected by CrowdSec / Wazuh on Echoserver Hetzner cluster (automated brute-force ban)
Brute-Force
SSH
Port Scan
🇺🇸
TPI-Abuse
2026-10-11 11:31:55
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 35.187.90.69 (69.90.187.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.187.90.69 (69.90.187.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 07:31:48.392712 2026] [security2:error] [pid 16551:tid 16551] [client 35.187.90.69:44788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "app.handyrehab.com"] [uri "/.htpasswd"] [unique_id "astzpOUq9hUMyW9jIqh_OAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-11 10:26:15
(6 days ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇧🇷
dermatovirtual
2026-10-11 10:05:06
(6 days ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 98 unauthorized requests recorded between 2026-10-11 10:03:07 UTC and 2026-10-11 10:03:15 UTC (rate: ~98 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-10-11 10:03:13 UTC] IP: 35.187.90.69 - W3C IIS (Port 443): GET /.env -> HTTP 404 [CLIENT: 35.187.90.69]
[2026-10-11 10:03:14 UTC] IP: 35.187.90.69 - W3C IIS (Port 443): GET /.env -> HTTP 404 [CLIENT: 35.187.90.69]
[2026-10-11 10:03:14 UTC] IP: 35.187.90.69 - W3C IIS (Port 443): GET /.env -> HTTP 404 [CLIENT: 35.187.90.69]
show less
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-10-11 09:38:50
(6 days ago)
(PERMBLOCK) 35.187.90.69 (BE/Belgium/Brussels Capital/Brussels/69.90.187.35.bc.googleusercontent.com ...
show more
(PERMBLOCK) 35.187.90.69 (BE/Belgium/Brussels Capital/Brussels/69.90.187.35.bc.googleusercontent.com/[redacted]) has had more than 4 temp blocks
show less
Hacking
🇬🇧
openstrike.co.uk
2026-10-11 05:14:32
(6 days ago)
181 attacks on PHP URLs, VC URLs, env grabbing URLs (type 2), password/key grabbing URLs, config gra ...
show more
181 attacks on PHP URLs, VC URLs, env grabbing URLs (type 2), password/key grabbing URLs, config grabbing URLs (type 2), directory traversals, env grabbing URLs:
GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ HTTP/1.1
GET /id_ecdsa HTTP/1.1
GET /secrets.yml HTTP/1.1
GET /..%2f.env HTTP/1.1
GET /css../.env HTTP/1.1
show less
Web App Attack
Hacking
🇺🇸
dot.mg
2026-10-11 03:46:03
(6 days ago)
Scan of vulnerable files
Web App Attack
🇩🇪
Hazzard
2026-10-11 03:15:09
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection