🇺🇸
thieuleu
2026-11-05 13:04:15
UTC ·
(1 day ago)
Unauthorized connection attempt blocked by firewall policy. Web application hardening active.
Brute-Force
Exploited Host
🇺🇸
TPI-Abuse
2026-11-05 12:17:28
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.198.15.58 (58.15.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:17:20.015477 2026] [security2:error] [pid 1113:tid 111 ...
show more
(mod_security) mod_security (id:210730) triggered by 35.198.15.58 (58.15.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:17:20.015477 2026] [security2:error] [pid 1113:tid 1113] [client 35.198.15.58:38664] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.thecrimsonpirate.com|F|2"] [data ".thecrimsonpirate.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.thecrimsonpirate.com"] [uri "/z9x8c7v6b5-debug-trigger-autodiscover.thecrimsonpirate.com"] [unique_id "auxz0A_Di9NHp5j9tvPlpQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
niedson
2026-11-05 11:00:01
UTC ·
(1 day ago)
Automated scanning for exposed secrets: repeated requests for multiple distinct credential paths (.env variants, .git metadata, .ssh private keys, .aws/credentials). Unsolicited. Reported automatically.
Web App Attack
🇹🇭
thaizone.com
2026-11-05 10:52:23
UTC ·
(1 day ago)
Brute Force Attack on a Web Resources (repeated 404) #1
DDoS Attack
Web Spam
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 08:07:47
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 35.198.15.58 (58.15.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 03:07:39.938030 2026] [security2:error] [pid 30927:tid 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.15.58 (58.15.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 03:07:39.938030 2026] [security2:error] [pid 30927:tid 30927] [client 35.198.15.58:55288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sprektech.com"] [uri "/.env.preprod"] [unique_id "auw5S4vzaNKSyXkUqopaJAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
oalver
2026-11-05 07:52:24
UTC ·
(1 day ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_rate_flood, nginx_path_signature. Sources: nginx. Details: path_signature: request to /.env.credentials (HTTP 301); rate_flood: 30 requests to ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_rate_flood, nginx_path_signature. Sources: nginx. Details: path_signature: request to /.env.credentials (HTTP 301); rate_flood: 30 requests to /.env.staging.local (HTTP 301) within 10s; 404_flood: 10 requests to /graphql (HTTP 404) within 60s. First seen: 2026-11-05. Risk score: 65/100.
show less
Web App Attack
🇭🇰
Mehmet_The_Script_Kiddie
2026-11-05 06:37:23
UTC ·
(1 day ago)
AUTOMATED REPORT: XXE Attacker, vulnerability scan: /sitemap_index.xml
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:10:46
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.198.15.58 (58.15.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:10:38.098950 2026] [security2:error] [pid 31622:tid 31 ...
show more
(mod_security) mod_security (id:210730) triggered by 35.198.15.58 (58.15.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:10:38.098950 2026] [security2:error] [pid 31622:tid 31622] [client 35.198.15.58:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.ralphrichardson.com|F|2"] [data ".ralphrichardson.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.ralphrichardson.com"] [uri "/z9x8c7v6b5-debug-trigger-autodiscover.ralphrichardson.com"] [unique_id "auwd3sdcg1emBVe6eiwcrAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-11-05 05:14:40
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇪🇸
masterguru
2026-11-05 03:26:50
UTC ·
(1 day ago)
BAD BOT - Detected and Blocked.. Matched phrase "ccbot" at REQUEST_HEADERS:User-Agent. (1100000-122)
Bad Web Bot
2026-11-05 02:43:03
UTC ·
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.next/.env HTTP/2.0, GET /.env.dev HTTP/2.0, GET /netlify.toml HTTP/2.0, GET /userfiles?path=../../../../.env HTTP/2.0, GET /wp-login.php?redirect_to=https%3A%2F%2Ftop5datingsites.be%, GET /wp-sitemap-post ...
show more
Bot / scanning and/or hacking attempts: GET /.next/.env HTTP/2.0, GET /.env.dev HTTP/2.0, GET /netlify.toml HTTP/2.0, GET /userfiles?path=../../../../.env HTTP/2.0, GET /wp-login.php?redirect_to=https%3A%2F%2Ftop5datingsites.be%, GET /wp-sitemap-posts-page-1.xml HTTP/2.0, GET /wp-sitemap.xml HTTP/2.0, GET /.env HTTP/2.0, GET /cache/original/%2e%2e/.env HTTP/2.0
show less
Hacking
Web App Attack
🇮🇹
Inartis
2026-11-05 02:16:49
UTC ·
(1 day ago)
35.198.15.58 - - [05/Nov/2026:03:16:48 +0100] "GET /.env.common HTTP/2.0" 404 224 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-11-05 01:28:46
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇨🇦
SSH-Admin
2026-11-05 00:52:02
UTC ·
(2 days ago)
Probing for Exploits on ns74
Exploited Host
Web App Attack
🇿🇦
conure.sh
2026-11-05 00:42:09
UTC ·
(2 days ago)
csagent: score 19.9: secrets grab x2; 1 domain(s) in 4s
Web App Attack
