🇩🇰
HostingGroup
2026-09-22 16:41:53
(17 hours ago)
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shiel ...
show more
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 2. First blocked: 2026-09-22.
show less
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-22 16:15:01
(17 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
CBJ
2026-09-22 16:08:41
(17 hours ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:06:22
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:06:16.222132 2026] [security2:error] [pid 17062:tid 17378] [client 35.198.39.185:50992] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "peoplecomeup.net"] [uri "/.env.old"] [unique_id "arKneDyh-1Iqe2v8qMwWnwAAAMU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
OceanTreasure
2026-09-22 15:30:37
(18 hours ago)
tcp/80; /.env* dotfile probe: "GET /.env.bak" @ 2026-09-22T15:26:18Z
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:28:03
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:27:57.897848 2026] [security2:error] [pid 7519:tid 7519] [client 35.198.39.185:33040] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "my-spec.com"] [uri "/.env.production"] [unique_id "arKefYdS7O-fWJwt6GK3UAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-22 14:26:30
(19 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
mnsf
2026-09-22 14:06:32
(19 hours ago)
Scanning/Probing (18)
Brute-Force
Web App Attack
🇺🇸
Charlesiv
2026-09-22 14:03:12
(19 hours ago)
Triggered Cloudflare WAF (firewallCustom) from BR.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from BR.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /actuator/env
Timestamp: 2026-09-22T14:02:39Z
Ray ID: a3f1d93f6c25ca4a
UA: crusader-worker/1.0
show less
Bad Web Bot
🇺🇦
URAN Publishing Service
2026-09-22 13:59:27
(19 hours ago)
[22/Sep/2026:16:59:27 +0300] -- 35.198.39.185 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env ...
show more
[22/Sep/2026:16:59:27 +0300] -- 35.198.39.185 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env.backup HTTP/1.1
show less
Bad Web Bot
Web App Attack
2026-09-22 13:40:39
(20 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-09-22 13:26:58
(20 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 13:21:13
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:21:05.142997 2026] [security2:error] [pid 14378:tid 14378] [client 35.198.39.185:57100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "garrelsms.com"] [uri "/.env.example"] [unique_id "arKAwbz7eVdeq4XRVKatYwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 12:17:55
(21 hours ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
TPI-Abuse
2026-09-22 12:12:48
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.39.185 (185.39.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:12:43.167267 2026] [security2:error] [pid 11591:tid 11591] [client 35.198.39.185:43478] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "debhill.alhill.com"] [uri "/.env.example"] [unique_id "arJwu4cpOOPxI2dqt9UD0gAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack