🇪🇸
elcruzado.es
2026-10-12 15:43:44
(54 minutes ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.189.138.188 (JP/J ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.189.138.188 (JP/Japan/188.138.189.35.bc.googleusercontent.com)
show less
Bad Web Bot
2026-10-12 15:16:51
(1 hour ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇩🇪
Vegascosmetics
2026-10-12 15:15:18
(1 hour ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after matched multi-pattern attack signatur ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after matched multi-pattern attack signature. Evidence: AttackPattern: /\.vite/ (Match: /.vite/)
show less
Hacking
Web App Attack
🇳🇱
vanadrighem.eu
2026-10-12 15:04:21
(1 hour ago)
Automatic Fail2ban report
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 14:59:08
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 35.189.138.188 (188.138.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.189.138.188 (188.138.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:59:02.810464 2026] [security2:error] [pid 22765:tid 22765] [client 35.189.138.188:59664] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vaghyst.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vaghyst.com"] [uri "/z9x8c7v6b5-debug-trigger-vaghyst.com"] [unique_id "asz1tryXKV1Ks48BxUbuDAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-10-12 14:50:53
(1 hour ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
iwle
2026-10-12 14:22:57
(2 hours ago)
[Mon Oct 12 10:22:55.466414 2026] [:error] [pid 12413:tid 12461] [client 35.189.138.188:0] [client 3 ...
show more
[Mon Oct 12 10:22:55.466414 2026] [:error] [pid 12413:tid 12461] [client 35.189.138.188:0] [client 35.189.138.188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ufscards.com"] [uri "/css../.env"] [unique_id "asztP80Bn7SWXY74qlt5vAAAANQ"]
[Mon Oct 12 10:22:55.480427 2026] [:error] [pid 333964:tid 334012] [client 35.189.138.188:0] [client 35.189.138.188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "
...
show less
Web App Attack
🇩🇪
tvipper.com
2026-10-12 14:18:47
(2 hours ago)
probing for exposed files and admin pages: 3 attempts within 10 minutes, seen by Cloudflare WAF (rep ...
show more
probing for exposed files and admin pages: 3 attempts within 10 minutes, seen by Cloudflare WAF (reported by RemotePower)
show less
Web App Attack
2026-10-12 13:45:35
(2 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
TPI-Abuse
2026-10-12 13:13:46
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.189.138.188 (188.138.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.189.138.188 (188.138.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 09:13:42.561551 2026] [security2:error] [pid 5191:tid 5191] [client 35.189.138.188:52970] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tobyscott.com"] [uri "/.htpasswd"] [unique_id "aszdBj8tELYkAO7zfYewxgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-12 13:11:42
(3 hours ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
WizardsToolkit
2026-10-12 12:46:14
(3 hours ago)
tried to access forbidden files; attempted to access /static//app/.env
Web App Attack
🇩🇪
Hazzard
2026-10-12 12:43:36
(3 hours ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇳🇱
Alt255
2026-10-12 12:35:19
(4 hours ago)
[ti-02ov] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[ti-02ov] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.189.138.188 - - [12/Oct/2026:14:35:02 +0200] "GET /yoep7j83ndke9n0zhk12 HTTP/2.0" 404 2004 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.189.138.188 - - [12/Oct/2026:14:35:02 +0200] "GET /z9x8c7v6b5-debug-trigger-theobrounstegelwerken.nl HTTP/2.0" 404 2004 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
35.189.138.188 - - [12/Oct/2026:14:35:02 +0200] "GET /mixbcfzorwupeaysco6v HTTP/2.0" 404 2004 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
35.189.138.188 - - [12/Oct/2026:14:35:02 +0200] "POST /login HTTP/2.0" 404 2004 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
35.189.138.188 - - [12/Oct/2026:14:35:02
...
show less
Bad Web Bot
Web App Attack
🇩🇪
svr
2026-10-12 12:34:22
(4 hours ago)
Abusive Automated Web Scanner
Web App Attack
