🇺🇸
TPI-Abuse
2026-09-23 22:19:57
(6 minutes ago)
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 18:19:53.800322 2026] [security2:error] [pid 27364:tid 27364] [client 35.196.163.150:34568] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vampireproductions.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vampireproductions.com"] [uri "/z9x8c7v6b5-debug-trigger-vampireproductions.com"] [unique_id "arRQiZp8LT5JCj-MeTYmbAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
vanderhost
2026-09-23 22:08:26
(17 minutes ago)
[Laravel HoneypotPlus] Automated report - Honeypot access detected on path: /storage/logs/laravel.lo ...
show more
[Laravel HoneypotPlus] Automated report - Honeypot access detected on path: /storage/logs/laravel.log via rule: /storage/logs
show less
Web App Attack
Bad Web Bot
🇺🇸
chrisj
2026-09-23 22:06:18
(19 minutes ago)
[Wed Sep 23 22:06:18.562844 2026] [proxy_fcgi:error] [pid 142938:tid 142953] [remote 35.196.163.150: ...
show more
[Wed Sep 23 22:06:18.562844 2026] [proxy_fcgi:error] [pid 142938:tid 142953] [remote 35.196.163.150:43698] AH01071: Got error 'Primary script unknown'
[Wed Sep 23 22:06:18.621182 2026] [proxy_fcgi:error] [pid 142938:tid 142947] [remote 35.196.163.150:43698] AH01071: Got error 'Primary script unknown'
[Wed Sep 23 22:06:18.663770 2026] [proxy_fcgi:error] [pid 142938:tid 142948] [remote 35.196.163.150:43698] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
🇧🇪
cmbplf
2026-09-23 22:04:51
(21 minutes ago)
11.140 4xx requests in 1 hour (4d16h12m)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-23 22:04:46
(21 minutes ago)
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 18:04:39.663008 2026] [security2:error] [pid 8189:tid 8189] [client 35.196.163.150:43942] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vanemby.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vanemby.com"] [uri "/z9x8c7v6b5-debug-trigger-vanemby.com"] [unique_id "arRM92IbuOusAavESWVzTQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-09-23 21:53:51
(32 minutes ago)
Try to access /.env.staging
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 21:48:42
(37 minutes ago)
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 17:48:38.339386 2026] [security2:error] [pid 30078:tid 30078] [client 35.196.163.150:39452] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vankesselporsche.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vankesselporsche.com"] [uri "/z9x8c7v6b5-debug-trigger-vankesselporsche.com"] [unique_id "arRJNuQEYlOj26hdKfYGMwAAAC8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-23 21:15:46
(1 hour ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
mnsf
2026-09-23 21:05:44
(1 hour ago)
Too many Status 40X (14)
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-09-23 20:51:20
(1 hour ago)
[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 35. ...
show more
[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 35.196.163.150 - - \[23/Sep/2026:22:51:11 +0200\] "GET /.env.example HTTP/1.1" 301 511 "-" "Mozilla/5.0 \(compatible\; MoonshotBot/1.0\; +https://kimi.ai/\)"
35.196.163.150 - - \[23/Sep/2026:22:51:11 +0200\] "GET /.env HTTP/1.1" 301 495 "-" "Mozilla/5.0 \(compatible\; PanguBot/1.0\; +https://www.huaweicloud.com/\)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-23 20:15:05
(2 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
[email protected]
2026-09-23 20:09:12
(2 hours ago)
CrowdSec ban: crowdsecurity/http-admin-interface-probing (duration: 71h59m59s)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 19:55:27
(2 hours ago)
(mod_security) mod_security (id:949110) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:949110) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 15:55:24.437018 2026] [security2:error] [pid 29508:tid 29508] [client 35.196.163.150:44048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vdeweese.com"] [uri "/z9x8c7v6b5-debug-trigger-vdeweese.com"] [unique_id "arQurHSToaD4tANbvo8pKgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-23 19:55:11
(2 hours ago)
Bot / seems abusive / Apache connections: 36
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 19:15:06
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.196.163.150 (150.163.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 15:15:01.899207 2026] [security2:error] [pid 19093:tid 19168] [client 35.196.163.150:59000] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||veganfiestas.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "veganfiestas.com"] [uri "/z9x8c7v6b5-debug-trigger-veganfiestas.com"] [unique_id "arQlNdz1FZSw0o-gUfypOwAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
