🇫🇮
paissangroup
2026-08-27 18:17:55
(19 minutes ago)
Multiple WAF Violations
Web App Attack
🇩🇪
Petros Stefanakis
2026-08-27 18:16:59
(20 minutes ago)
(mod_security) mod_security triggered on hostname [redacted] 35.192.3.218 (US/United States/218.3.19 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.192.3.218 (US/United States/218.3.192.35.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-08-27 17:18:01
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 13:17:56.976035 2026] [security2:error] [pid 6888:tid 6888] [client 35.192.3.218:38792] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lemobba.com"] [uri "/.env.bak"] [unique_id "apBxRP3Te7scIszZ1rEXsAAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
mr.joecat
2026-08-27 16:59:26
(1 hour ago)
35.192.3.218 - - [27/Aug/2026:18:59:26 +0200] "GET /env HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
...
show more
35.192.3.218 - - [27/Aug/2026:18:59:26 +0200] "GET /env HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
35.192.3.218 - - [27/Aug/2026:18:59:26 +0200] "GET /crusader-404-probe HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
35.192.3.218 - - [27/Aug/2026:18:59:26 +0200] "GET /actuator/configprops HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
35.192.3.218 - - [27/Aug/2026:18:59:26 +0200] "GET /wp-config.php.swp HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
35.192.3.218 - - [27/Aug/2026:18:59:26 +0200] "GET /.env.production HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:53:42
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:53:38.544716 2026] [security2:error] [pid 8859:tid 8859] [client 35.192.3.218:53206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.prestigedomainsales.com.crazycoin.net"] [uri "/.env.bak"] [unique_id "apBrkouLGHOp7knd1Y_phAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:36:50
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:36:43.210821 2026] [security2:error] [pid 23921:tid 24050] [client 35.192.3.218:53004] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.texas-plastic-surgeon.aafm.us"] [uri "/.env.production"] [unique_id "apBnmybNpIAoKLk2P_awrAAAAgk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-08-27 16:20:44
(2 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-08-27 16:10:30
(2 hours ago)
[ThuAug2718:10:28.0299692026][security2:error][pid1579655:tid1579942][client35.192.3.218:0]ModSecuri ...
show more
[ThuAug2718:10:28.0299692026][security2:error][pid1579655:tid1579942][client35.192.3.218:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"minondou-togo.ch\"][uri\"/.env.backup\"][unique_id\"apBhdIgwCITwAQ07jI0KMwAAARE\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 15:50:07
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 11:50:02.133018 2026] [security2:error] [pid 24768:tid 24768] [client 35.192.3.218:60514] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "4bearspress.wolter-hausser.com"] [uri "/.env.bak"] [unique_id "apBcqhmF_V_0x2_A7yYGgAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Keith Beucler
2026-08-27 14:48:51
(3 hours ago)
K5 Services fail2ban jail nginx-k5-web-probes detected high-confidence web abuse. Local web ban appl ...
show more
K5 Services fail2ban jail nginx-k5-web-probes detected high-confidence web abuse. Local web ban applied. Categories: 19,21.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 14:39:54
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:39:49.652163 2026] [security2:error] [pid 4220:tid 4220] [client 35.192.3.218:33054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "natesupport.com"] [uri "/wp-config.php.swp"] [unique_id "apBMNXO6ZAO8OdsdRdMK2AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 14:22:26
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:22:19.005512 2026] [security2:error] [pid 4452:tid 4452] [client 35.192.3.218:54854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arteseros.com"] [uri "/.env.backup"] [unique_id "apBIG6kJiSjc_Isp-gjc2QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
ycoskun41
2026-08-27 14:03:23
(4 hours ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇩🇪
big-cloud.nl
2026-08-27 13:16:37
(5 hours ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 13:01:58
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.192.3.218 (218.3.192.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 09:01:52.625905 2026] [security2:error] [pid 29983:tid 29983] [client 35.192.3.218:51214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.luisguacache.com"] [uri "/.env.example"] [unique_id "apA1QIiF3dtQMF-ZnbvdUwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack