2026-09-21 07:30:03
(4 weeks ago)
CrowdSec decision: crowdsecurity/http-crawl-non_statics (origin: crowdsec)
Port Scan
🇷🇴
iulianh
2026-09-21 06:15:54
(4 weeks ago)
80,443
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-09-21 05:34:30
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:34:24.555988 2026] [security2:error] [pid 5631:tid 5631] [client 35.189.185.106:48496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.boatregistrationdelaware.com"] [uri "/.git/config"] [unique_id "arDB4HriYtdQE4SZBU2BogAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 04:35:19
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:35:11.177171 2026] [security2:error] [pid 19649:tid 19649] [client 35.189.185.106:42964] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.haddadpharmacy.com"] [uri "/@fs/app/.env"] [unique_id "arCz_9-VrWcb1ICyzdiiAwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Sling
2026-09-21 04:06:03
(4 weeks ago)
Automated detection: IP accessed 13 sensitive endpoints within 30s on local.slingexe.com. Paths: /in ...
show more
Automated detection: IP accessed 13 sensitive endpoints within 30s on local.slingexe.com. Paths: /index.php, /.aws/credentials, /.env.local, /.env.production, /.env.stage, /pages/index.astro.mjs.map, /storage/logs/laravel.log, /application.yml, /.env.example, /.env.backup. UA: Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/).
show less
Web App Attack
Bad Web Bot
Hacking
🇸🇪
vaia.cloud
2026-09-21 03:45:02
(4 weeks ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇺🇸
Sling
2026-09-21 02:55:55
(4 weeks ago)
Automated detection: IP accessed 8 sensitive endpoints within 30s on local.slingexe.com. Paths: /.en ...
show more
Automated detection: IP accessed 8 sensitive endpoints within 30s on local.slingexe.com. Paths: /.env.local, /_astro/pages/index.astro.mjs.map, /index.php, /application.properties, /.git-credentials, /.env.example, /secrets.json, /docker-compose.yml. UA: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/).
show less
Web App Attack
Bad Web Bot
Hacking
🇺🇸
TPI-Abuse
2026-09-21 02:27:04
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:26:58.977689 2026] [security2:error] [pid 22704:tid 22704] [client 35.189.185.106:55724] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||haidarmedical.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "haidarmedical.com"] [uri "/z9x8c7v6b5-debug-trigger-haidarmedical.com"] [unique_id "arCV8gUBLVOi-E38xl4v9QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-09-21 01:33:00
(4 weeks ago)
block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1
Bad Web Bot
🇩🇪
Philister11
2026-09-21 00:47:09
(1 month ago)
CrowdSec: crowdsecurity/http-bad-user-agent (TW/AS396982)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 00:44:57
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:44:52.627564 2026] [security2:error] [pid 18599:tid 18599] [client 35.189.185.106:58178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.grupoimaginarte.com"] [uri "/@fs/app/.env"] [unique_id "arB-BF9oLn_TygcX6UlzYAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 23:30:03
(1 month ago)
CrowdSec decision: crowdsecurity/thinkphp-cve-2018-20062 (origin: crowdsec)
Port Scan
🇺🇸
TPI-Abuse
2026-09-20 23:20:20
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:20:12.192323 2026] [security2:error] [pid 2073:tid 2073] [client 35.189.185.106:45952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.verdadesreales.com"] [uri "/.git/config"] [unique_id "arBqLJ3oytgwS0lwrql-WwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 22:30:04
(1 month ago)
CrowdSec decision: crowdsecurity/http-path-traversal-probing (origin: crowdsec)
Port Scan
🇺🇸
TPI-Abuse
2026-09-20 21:35:53
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.189.185.106 (106.185.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:35:47.018665 2026] [security2:error] [pid 31749:tid 31749] [client 35.189.185.106:40320] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.hacertests.com|F|2"] [data ".hacertests.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.hacertests.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.hacertests.com"] [unique_id "arBRszR-NJS_ZGW3z0G5aAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
