🇮🇹
keope
2026-10-22 20:13:02
(4 days ago)
CrowdSec Automated Sync - Reason: crowdsec_cve_2025_55182
Brute-Force
Web App Attack
🇺🇸
[email protected]
2026-09-21 16:45:32
(1 month ago)
CrowdSec ban: crowdsecurity/unifi-flood-detection (duration: 71h59m51s)
Port Scan
🇳🇱
Site.eu
2026-09-21 06:21:40
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-09-21 04:12:43
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:12:39.622118 2026] [security2:error] [pid 19354:tid 19354] [client 35.190.214.131:53104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.idledog.com"] [uri "/.env.local"] [unique_id "arCut53eBbS4jUPiVN7luwAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bazter.pro
2026-09-21 02:16:40
(1 month ago)
Fail2Ban: apache-ratelimit - 20 failures
Port Scan
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-21 02:05:35
(1 month ago)
Scanning/Probing (17)
Brute-Force
Web App Attack
🇩🇪
SCHAPPY
2026-09-21 01:59:57
(1 month ago)
Malicious activity from IP detected: crowdsecurity/http-probing.
Web App Attack
Hacking
🇩🇪
updown.io
2026-09-20 23:41:59
(1 month ago)
{"level":"info","ts":1789947718.5124636,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1789947718.5124636,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.190.214.131","remote_port":"37488","client_ip":"35.190.214.131","proto":"HTTP/2.0","method":"GET","host":"status.pinside.com","uri":"/.aws/credentials","headers":{"X-Nextjs-Data":["1"],"User-Agent":["CCBot/2.0 (https://commoncrawl.org/faq/)"],"Accept":["*/*"],"Accept-Encoding":["gzip"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.pinside.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.000195683,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1789947718.5146012,"logger":"http.log.access.log1","msg":"handled request","request":{"remo
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:30:11
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:30:04.721052 2026] [security2:error] [pid 8765:tid 8765] [client 35.190.214.131:53456] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelholdengc.com"] [uri "/shop/.env"] [unique_id "arBsfFTLiqD_aAxsoBNTQgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 22:46:10
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 18:46:02.472417 2026] [security2:error] [pid 30146:tid 30146] [client 35.190.214.131:50388] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ifilemuseum.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ifilemuseum.com"] [uri "/z9x8c7v6b5-debug-trigger-ifilemuseum.com"] [unique_id "arBiKh0vyTdQCBT9TJhNSAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 22:29:58
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-20 22:27:19
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.190.214.131 (131.214.190.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 18:27:12.622584 2026] [security2:error] [pid 1967:tid 1967] [client 35.190.214.131:43214] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.iayecaptain.com|F|2"] [data ".iayecaptain.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.iayecaptain.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.iayecaptain.com"] [unique_id "arBdwGL3e9p6IaR3DteG0AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-20 22:04:33
(1 month ago)
[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.190.214.131 - - [21/Sep/2026:00:04:33 +0200] "GET /.env.example HTTP/1.1" 403 584 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
...
show less
Bad Web Bot
Web App Attack
2026-09-20 21:49:51
(1 month ago)
Aggressive web scan
Web App Attack
🇫🇷
Quarks Solutions
2026-09-20 21:34:27
(1 month ago)
crowdsecurity/appsec-vpatch
Web App Attack