🇧🇪
cmbplf
2026-10-07 06:35:25
(1 week ago)
203 requests with url.path *.env
Brute-Force
Bad Web Bot
🇬🇧
consul.to
2026-10-07 06:17:13
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-07 04:31:50
(1 week ago)
Attempted access to sensitive endpoint (/cache/original/%2e%2e/%2e%2e/.env) detected. Automated scan ...
show more
Attempted access to sensitive endpoint (/cache/original/%2e%2e/%2e%2e/.env) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇩🇪
updown.io
2026-10-07 01:30:04
(1 week ago)
{"level":"info","ts":1791336600.9782372,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791336600.9782372,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.198.23.140","remote_port":"56902","client_ip":"35.198.23.140","proto":"HTTP/2.0","method":"GET","host":"status.onward.flights","uri":"/asset-manifest.json","headers":{"Sec-Fetch-User":["?1"],"Sec-Ch-Ua-Mobile":["?1"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Microsoft Edge\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Fetch-Dest":["document"],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"],"Sec-Fetch-Site":["none"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua-Platform":["\"Android\""],"Priority":["u=0, i"],"X-Nextjs-Data":["1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-M
...
show less
DDoS Attack
Web App Attack
🇹🇼
tye
2026-10-06 20:44:55
(1 week ago)
Wazuh Alert Evidence: 35.198.23.140 (35.198.23.140) - - [07/Oct/2026:04:44:53 +0800] "GET /tf804zib5 ...
show more
Wazuh Alert Evidence: 35.198.23.140 (35.198.23.140) - - [07/Oct/2026:04:44:53 +0800] "GET /tf804zib5asnni04u2wz HTTP/1.1" 404 465 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
show less
Web App Attack
2026-10-06 17:28:48
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇺🇸
CBJ
2026-10-06 10:47:19
(1 week ago)
fail2ban: apache-random-recon
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 09:40:34
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.198.23.140 (140.23.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.23.140 (140.23.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 05:40:29.212531 2026] [security2:error] [pid 18836:tid 18836] [client 35.198.23.140:50730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.oldtowntownship-il.gov"] [uri "/files../.env"] [unique_id "asTCDeLIJLfT8lGiH1ye9wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-06 08:29:10
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
2026-10-06 08:10:59
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇩🇪
rh24
2026-10-06 08:10:36
(1 week ago)
(badbots) Bad bot user-agent [redacted] from 35.198.23.140 (BR/Brazil/140.23.198.35.bc.googleusercon ...
show more
(badbots) Bad bot user-agent [redacted] from 35.198.23.140 (BR/Brazil/140.23.198.35.bc.googleusercontent.com)
show less
Hacking
2026-10-06 06:53:40
(1 week ago)
35.198.23.140 - - [06/Oct/2026:14:53:38 +0800] "GET /jmy4e891pc9qkgptf2k9 HTTP/1.1" 404 322 "https:/ ...
show more
35.198.23.140 - - [06/Oct/2026:14:53:38 +0800] "GET /jmy4e891pc9qkgptf2k9 HTTP/1.1" 404 322 "https://itdefence.asia/jmy4e891pc9qkgptf2k9" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" "-"
35.198.23.140 - - [06/Oct/2026:14:53:38 +0800] "GET /dist/manifest.json HTTP/1.1" 404 322 "https://itdefence.asia/dist/manifest.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-"
35.198.23.140 - - [06/Oct/2026:14:53:38 +0800] "GET /manifest.json HTTP/1.1" 404 322 "https://itdefence.asia/manifest.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-"
35.198.23.140 - - [06/Oct/2026:14:53:38 +0800] "GET /webpack-stats.json HTTP/1.1" 404 322 "https://itdefence.asia/webpack-stats.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-"
35.198.23.140 - - [06/Oct/
...
show less
Web App Attack
🇵🇱
Niko's Stuff
2026-10-06 06:35:20
(1 week ago)
Triggered crowdsecurity/http-probing. More information at: https://app.crowdsec.net/cti/35.198.23.14 ...
show more
Triggered crowdsecurity/http-probing. More information at: https://app.crowdsec.net/cti/35.198.23.140
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-06 06:28:19
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.198.23.140 (140.23.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.23.140 (140.23.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 02:28:13.354514 2026] [security2:error] [pid 14551:tid 14551] [client 35.198.23.140:58344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cityoffoley.gov"] [uri "/.env"] [unique_id "asSU_VG_pzZjWnIuXxIdEAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-06 06:14:03
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
