🇪🇸
Gem
2026-11-06 23:07:58
UTC ·
(17 hours ago)
Unauthorized web scan.
Web App Attack
🇦🇺
BorderTechSolutions
2026-11-06 19:18:13
UTC ·
(21 hours ago)
Scanner probing for secrets/webshells on an API host: GET /.next/build-manifest.json. Hit a honeypot path that serves nothing real.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 16:08:51
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.196.176.219 (219.176.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 11:08:47.415473 2026] [security2:error] [pid 22618:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 35.196.176.219 (219.176.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 11:08:47.415473 2026] [security2:error] [pid 22618:tid 22618] [client 35.196.176.219:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.shubil.com|F|2"] [data ".shubil.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.shubil.com"] [uri "/z9x8c7v6b5-debug-trigger-www.shubil.com"] [unique_id "au37j9-NcQg7q_admpUpYgAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
oalver
2026-11-06 15:53:57
UTC ·
(1 day ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_rate_flood, nginx_path_signature. Sources: nginx. Details: 404_flood: 10 requests to /graphql (HTTP 404) within 60s; path_signature: request to ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_rate_flood, nginx_path_signature. Sources: nginx. Details: 404_flood: 10 requests to /graphql (HTTP 404) within 60s; path_signature: request to /frontend/.env (HTTP 404); rate_flood: 30 requests to /files../.env (HTTP 404) within 10s. First seen: 2026-11-06. Risk score: 65/100.
show less
Web App Attack
2026-11-06 15:30:26
UTC ·
(1 day ago)
Suspicious enumeration attempts on WP site
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-11-06 15:28:20
UTC ·
(1 day ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
2026-11-06 14:45:04
UTC ·
(1 day ago)
Observed scanned 87 known-sensitive endpoint(s), e.g.: /%2eenv, /....//....//....//..../.env, /.//.env, /.boto, /.dev.vars, /.dockerenv
Bad Web Bot
Web App Attack
🇦🇹
SchiWaGoA
2026-11-06 14:08:30
UTC ·
(1 day ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
2026-11-06 13:35:23
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇦🇺
2000cn.com.au
2026-11-06 13:02:34
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇳🇱
Alt255
2026-11-06 11:16:08
UTC ·
(1 day ago)
[ti-22al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.196.176.219 - - [06/Nov/2026:12:15:59 +0100] "GET /sitemap.xml HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +htt ...
show more
[ti-22al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.196.176.219 - - [06/Nov/2026:12:15:59 +0100] "GET /sitemap.xml HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
35.196.176.219 - - [06/Nov/2026:12:16:00 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
35.196.176.219 - - [06/Nov/2026:12:16:00 +0100] "GET /l251h6c27p9g74asmj6m HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
35.196.176.219 - - [06/Nov/2026:12:16:00 +0100] "GET /z9x8c7v6b5-debug-trigger-sandbox.mediarotterdam.nl HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
35.196.176.219
...
show less
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-06 09:26:30
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773
Web App Attack
Hacking
🇩🇪
hidemail.app
2026-11-06 08:52:51
UTC ·
(1 day ago)
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
Web App Attack
Hacking
🇳🇱
thedreamer.nl
2026-11-06 08:39:58
UTC ·
(1 day ago)
35.196.176.219 - - [06/Nov/2026:09:36:56 +0100] "GET / HTTP/2.0" 403 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "US" "North Charleston" "32.86080" "-79 ...
show more
35.196.176.219 - - [06/Nov/2026:09:36:56 +0100] "GET / HTTP/2.0" 403 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "US" "North Charleston" "32.86080" "-79.97460"
35.196.176.219 - - [06/Nov/2026:09:36:56 +0100] "GET /robots.txt HTTP/2.0" 403 107 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" "US" "North Charleston" "32.86080" "-79.97460"
35.196.176.219 - - [06/Nov/2026:09:36:56 +0100] "GET /sitemap.xml HTTP/2.0" 403 107 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" "US" "North Charleston" "32.86080" "-79.97460"
35.196.176.219 - - [06/Nov/2026:09:36:56 +0100] "GET /sitemap_index.xml HTTP/2.0" 403 107 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" "US" "North Charleston" "32.86080" "-79.97460"
35.196.176.219 - - [06/Nov/2026:09:36:56 +0100] "GET /webhooks HTTP/2.0" 403 169 "
...
show less
Brute-Force
Bad Web Bot
🇩🇪
Ilop
2026-11-06 08:30:13
UTC ·
(1 day ago)
[hp-100] 4 unsolicited packets to honeypot ports 8443,443,8080,80 (OCI DShield sensor)
Port Scan
