🇳🇱
Roderic
2026-11-06 10:20:04
UTC ·
(6 days ago)
Insights: 9 probe requests within 24 hours on 1 site, e.g. /static//.env (no normal page views)
Web App Attack
🇳🇱
Alt255
2026-11-06 09:54:32
UTC ·
(6 days ago)
[ti-30al] Excessive 404 errors (web scanning): 29 suspicious requests detected by fail2ban jail apache-404. Example: 35.198.94.40 - - [06/Nov/2026:10:54:09 +0100] "GET /bk4rxec27bnkkrtn7ic3 HTTP/2.0" 404 2020 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTM ...
show more
[ti-30al] Excessive 404 errors (web scanning): 29 suspicious requests detected by fail2ban jail apache-404. Example: 35.198.94.40 - - [06/Nov/2026:10:54:09 +0100] "GET /bk4rxec27bnkkrtn7ic3 HTTP/2.0" 404 2020 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
35.198.94.40 - - [06/Nov/2026:10:54:09 +0100] "GET /ujxo12251tg4v6016u31 HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.198.94.40 - - [06/Nov/2026:10:54:09 +0100] "GET /z9x8c7v6b5-debug-trigger-staging.syneast.nl HTTP/2.0" 404 2020 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
35.198.94.40 - - [06/Nov/2026:10:54:10 +0100] "GET /.env.dev HTTP/2.0" 404 2020 "-
...
show less
Bad Web Bot
Web App Attack
🇮🇳
Mr.Singh
2026-11-06 09:30:22
UTC ·
(6 days ago)
NFT blocked 35.198.94.40 after 2 rejections on 06-Nov-2026.
Port Scan
Brute-Force
🇩🇪
kkw
2026-11-06 09:09:52
UTC ·
(6 days ago)
[REDACTED] 35.198.94.40 - - [06/Nov/2026:10:09:52 +0100] "GET /assets../.env HTTP/2.0" 404 281975 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
... (mode: searching http-sensitive-files)
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-06 08:52:14
UTC ·
(6 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: mail.budyn.ovh | Path: /.vite/manifest.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: mail.budyn.ovh | Path: /.vite/manifest.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
Anonymous
2026-11-06 08:12:23
UTC ·
(6 days ago)
Web application attack: http cve 2021 41773; Web application attack: http path traversal probing; Web application attack: http sensitive files; Probing for exposed secret / credential files
Hacking
Web App Attack
🇧🇪
cmbplf
2026-11-06 05:32:55
UTC ·
(6 days ago)
1.249 requests with url.path *.env
Brute-Force
Bad Web Bot
🇦🇺
Proxay Fox
2026-11-06 05:30:44
UTC ·
(6 days ago)
35.198.94.40 - - [06/Nov/2026:15:30:12 +1000] "GET /sitemap.xml HTTP/2.0" 301 0 "https://www.ecoflo.com.au/sitemap.xml" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" "192.168.191.137,35.198.94.40" 404 353 TLSv1.3/TLS_AES_256_GCM_SHA384 ...
show more
35.198.94.40 - - [06/Nov/2026:15:30:12 +1000] "GET /sitemap.xml HTTP/2.0" 301 0 "https://www.ecoflo.com.au/sitemap.xml" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" "192.168.191.137,35.198.94.40" 404 353 TLSv1.3/TLS_AES_256_GCM_SHA384 . bb2865257224dfbb3ce6dcb6309f5a3e0b09dedacb24f89cd1eb203241d2117b
35.198.94.40 - - [06/Nov/2026:15:30:38 +1000] "GET /z9x8c7v6b5-debug-trigger-www.ecoflo.com.au HTTP/2.0" 404 22233 "https://www.ecoflo.com.au/z9x8c7v6b5-debug-trigger-www.ecoflo.com.au" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" "192.168.74.108,35.198.94.40" 396 22662 TLSv1.3/TLS_AES_256_GCM_SHA384 . bb2865257224dfbb3ce6dcb6309f5a3e0b09dedacb24f89cd1eb203241d2117b
35.198.94.40 - - [06/Nov/2026:15:30:38 +1000] "GET /k5c3xg09spnrmrjcqwl1 HTTP/2.0" 404 22232 "https://www.ecoflo.com.au/k5c3xg09spnrmrjcqwl1" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" "172.24.20.227
...
show less
Brute-Force
Web App Attack
🇩🇪
findlab
2026-11-06 05:15:01
UTC ·
(6 days ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-11-06 04:56:01
UTC ·
(6 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇿🇦
conure.sh
2026-11-06 04:45:08
UTC ·
(6 days ago)
csagent: score 21.0: 404 noise floor x4, secrets grab x2; 1 domain(s) in 12s
Web App Attack
🇫🇷
LoneRider
2026-11-06 04:15:21
UTC ·
(6 days ago)
[06/Nov/2026:05:15:17.833692 +0100] au1UVTOSQ18TWJugrMIrdAAAAAI 35.198.94.40 36604 127.0.0.1 7081
[06/Nov/2026:05:15:21.079817 +0100] au1UWVed1frGeLLkpzOdNQAAAAA 35.198.94.40 37048 127.0.0.1 7081
[06/Nov/2026:05:15:21.080672 +0100] au1UWcxoCcfpheTkQw ...
show more
[06/Nov/2026:05:15:17.833692 +0100] au1UVTOSQ18TWJugrMIrdAAAAAI 35.198.94.40 36604 127.0.0.1 7081
[06/Nov/2026:05:15:21.079817 +0100] au1UWVed1frGeLLkpzOdNQAAAAA 35.198.94.40 37048 127.0.0.1 7081
[06/Nov/2026:05:15:21.080672 +0100] au1UWcxoCcfpheTkQw757gAAAAU 35.198.94.40 37050 127.0.0.1 7081
...
show less
Hacking
🇩🇪
palla89
2026-11-06 04:02:03
UTC ·
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.198.94.40 (DE/Germany/40.94.198.35.bc.googleusercontent.com)
SQL Injection
🇮🇩
aaKenshin
2026-11-06 03:51:38
UTC ·
(6 days ago)
Suspicious activity detected from IP 35.198.94.40 based on web server logs.
Sample logs:
[geopark-] 35.198.94.40 - - [06/Nov/2026:11:51:32 +0800] "GET /staging/.env HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://develo ...
show more
Suspicious activity detected from IP 35.198.94.40 based on web server logs.
Sample logs:
[geopark-] 35.198.94.40 - - [06/Nov/2026:11:51:32 +0800] "GET /staging/.env HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
[geopark-] 35.198.94.40 - - [06/Nov/2026:11:51:32 +0800] "GET /webhooks HTTP/2.0" 404 170 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
[geopark-] 35.198.94.40 - - [06/Nov/2026:11:51:32 +0800] "POST /graphql HTTP/2.0" 404 170 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
Reported automatically by fail2ban service.
show less
Web App Attack
🇩🇪
netclix.gr
2026-11-06 03:43:59
UTC ·
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.198.94.40 (DE/Germany/40.94.198.35.bc.googleusercontent.com)
SQL Injection