🇳🇱
Site.eu
2026-06-08 23:40:40
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
dave
2026-06-08 14:13:25
(2 weeks ago)
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity ...
show more
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity/appsec-vpatch,crowdsecurity/vpatch-env-access targets=cloud hit_count=3 first_seen=2026-06-08T14:13:26Z last_seen=2026-06-08T14:13:25Z
show less
Web App Attack
🇫🇷
masterguru
2026-06-08 13:05:59
(2 weeks ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.195.132.35 (BE/Belgium/35.132.195. ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.195.132.35 (BE/Belgium/35.132.195.35.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
show less
Hacking
🇳🇱
e.fierstra
2026-06-08 12:35:28
(2 weeks ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-06-08 10:51:10
(2 weeks ago)
20 attempts against mh_ha-misbehave-ban on sedna
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
R.G.
2026-06-08 10:26:26
(2 weeks ago)
(ScanningForFiles) Scanning for files triggerd 35.195.132.35 (BE/Belgium/35.132.195.35.bc.googleuser ...
show more
(ScanningForFiles) Scanning for files triggerd 35.195.132.35 (BE/Belgium/35.132.195.35.bc.googleusercontent.com): 10 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 06:07:06
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.195.132.35 (35.132.195.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.195.132.35 (35.132.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 02:07:02.259748 2026] [security2:error] [pid 11594:tid 11594] [client 35.195.132.35:48330] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.myatherapy.abecasis.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.myatherapy.abecasis.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiZcBsZguEOYO0E4J9kNhwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-08 05:53:55
(2 weeks ago)
BAD BOT - Detected and Blocked.. Matched phrase "YaBrowser" at REQUEST_HEADERS:User-Agent. (1100000- ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "YaBrowser" at REQUEST_HEADERS:User-Agent. (1100000-193)
show less
Bad Web Bot
2026-06-08 04:27:19
(2 weeks ago)
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /aws_credentials.json HTTP/1.1" 404 196 "-" "Moz ...
show more
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /aws_credentials.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/8.0.8 Safari/600.8.9"
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /aws.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /aws.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /serviceaccount.json HTTP/1.1" 404 196 "-" "ELinks/0.12~pre5-4"
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /serviceaccount.json HTTP/1.1" 404 196 "-" "ELinks/0.12~pre5-4"
35.195.132.35 - - [08/Jun/2026:12:27:19 +0800] "GET /gcp.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Linux x86_
...
show less
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-06-08 03:38:59
(2 weeks ago)
Try to access /.aws/credentials
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 03:11:11
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.195.132.35 (35.132.195.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.195.132.35 (35.132.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 23:11:06.970007 2026] [security2:error] [pid 19908:tid 19908] [client 35.195.132.35:56164] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gooch-excavation.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gooch-excavation.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiYyypVrx1Yly7z7G5GoqQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 02:39:42
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.195.132.35 (35.132.195.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.195.132.35 (35.132.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 22:39:35.957189 2026] [security2:error] [pid 13652:tid 13652] [client 35.195.132.35:57514] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||octaviomontes.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "octaviomontes.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiYrZwEVZiNhWXOCgkXkYgAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-08 02:35:54
(2 weeks ago)
Aggressive web scan
Web App Attack
🇺🇸
mnsf
2026-06-08 02:06:55
(2 weeks ago)
Scanning/Probing (53)
Request Overload (206)
Brute-Force
Web App Attack
🇫🇷
Guardian
2026-06-08 02:00:20
(2 weeks ago)
Multi abuses [2]: Unauthorized connection attempt / Port scanning (x164), Unauthorized attempt to re ...
show more
Multi abuses [2]: Unauthorized connection attempt / Port scanning (x164), Unauthorized attempt to retrieve configuration file
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/heapdump HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/env HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/configprops HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/logfile HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/threaddump HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/dump HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/trace HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/httptrace HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/sessions HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /actuator/auditevents HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /heapdump HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /configprops HTTP/1.1"
35.195.132.35 [08/Jun/2026:02:00:18] "GET /env HTTP/1.1"
35.195.
show less
Port Scan
Web App Attack