2026-10-10 02:58:29
(1 week ago)
fail2ban jail apache-scanner: 35.198.86.187 - - [08/Oct/2026:13:27:31 -0700] "GET /.ssh/id_rsa HTTP/ ...
show more
fail2ban jail apache-scanner: 35.198.86.187 - - [08/Oct/2026:13:27:31 -0700] "GET /.ssh/id_rsa HTTP/1.1" 404 123656 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "GET /.ssh/id_ed25519 HTTP/1.1" 404 123656 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)" 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "GET /.ssh/config HTTP/1.1" 404 123656 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "GET /server.key HTTP/1.1" 404 127584 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "GET /.zshrc HTTP/1.1" 404 127583 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)" 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "POST /graphql HTTP/1.1" 404 127582
show less
Web App Attack
Port Scan
🇨🇭
d0n1s1k
2026-10-09 04:49:00
(1 week ago)
[BunkerWeb] block (reason: blacklist)
GET /fa8q9f5ow0oprfoff454
UA: Mozilla/5.0 AppleWebKit/537.36 ( ...
show more
[BunkerWeb] block (reason: blacklist)
GET /fa8q9f5ow0oprfoff454
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
show less
Web App Attack
Brute-Force
2026-10-08 22:32:50
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇮🇹
VHosting
2026-10-08 21:35:04
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-10-08 21:33:05
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
2026-10-08 21:23:32
(1 week ago)
Repeated unauthorized connection attempts to restricted service observed.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 20:50:42
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.198.86.187 (187.86.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.86.187 (187.86.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 16:50:35.803195 2026] [security2:error] [pid 11850:tid 11850] [client 35.198.86.187:57948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ospectra.ai"] [uri "/assets../.env"] [unique_id "asgCGwLHXUH3bybY7jKc6QAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
daveoctober
2026-10-08 20:43:10
(1 week ago)
October Sentinel: honeypot triggered
Bad Web Bot
Web App Attack
2026-10-08 20:27:35
(1 week ago)
fail2ban jail apache-secrets-probe: 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "GET /.zshrc HTTP ...
show more
fail2ban jail apache-secrets-probe: 35.198.86.187 - - [08/Oct/2026:13:27:32 -0700] "GET /.zshrc HTTP/1.1" 404 127583 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
show less
Web App Attack
🇬🇧
consul.to
2026-10-08 18:40:39
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
Alt255
2026-10-08 17:29:52
(1 week ago)
[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.198.86.187 - - [08/Oct/2026:19:29:50 +0200] "GET /.env.example HTTP/1.1" 301 602 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 17:03:36
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.198.86.187 (187.86.198.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.198.86.187 (187.86.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 13:03:29.219931 2026] [security2:error] [pid 4367:tid 4367] [client 35.198.86.187:45896] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ameliaschaaf.lawyer"] [uri "/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env"] [unique_id "asfM4ZNi-dT_K_RJVcCmGAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-08 17:00:13
(1 week ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection