🇳🇱
homeshowdomain.nl
2026-06-15 21:59:03
(2 days ago)
Auto-ban: >3000 req/min op 2026-06-15
Web App Attack
SSH
Hacking
🇹🇼
ip4.tw
2026-06-15 10:02:01
(2 days ago)
Malicious web scan
Hacking
Web App Attack
🇨🇦
SSH-Admin
2026-06-15 09:00:04
(2 days ago)
Probing for Exploits on ns200
Exploited Host
Web App Attack
🇳🇿
Antinson
2026-06-15 08:12:03
(2 days ago)
Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
Bad Web Bot
🇬🇧
OptimusGO
2026-06-15 08:07:47
(2 days ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-15 09:07:47 UTC
Log evidence:
06/15/2026-09:07:47.025892 [wDrop] [**] [1:7000500:1] FINSERV CRITICAL: Aggressive Port Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 35.199.124.128:51824 -> 185.127.18.66:443
06/15/2026-09:07:47.025892 [**] [1:9000060:2] AUTONOMOUS Long-term Reconnaissance [**] [Classification: (null)] [Priority: 2] {TCP} 35.199.124.128:51824 -> 185.127.18.66:443
show less
Port Scan
Brute-Force
🇺🇸
WellSpring
2026-06-15 07:50:26
(2 days ago)
git exposure on naturologie.com/www/.git/config — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 07:43:04
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.199.124.128 (128.124.199.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.199.124.128 (128.124.199.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 03:42:58.343576 2026] [security2:error] [pid 4336:tid 4336] [client 35.199.124.128:60246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "raaksystems.com"] [uri "/v1/.git/config"] [unique_id "ai-tArt0HkJl94pRJUnHzAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
SSH-Admin
2026-06-15 06:03:02
(2 days ago)
Probing for Exploits on ns74
Exploited Host
Web App Attack
🇳🇱
debestelapp
2026-06-15 05:30:10
(2 days ago)
Web App Attack
🇬🇧
cg-design.co.uk
2026-06-15 05:19:18
(2 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.199.124.128 (BR/Brazil/128.124.199.3 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.199.124.128 (BR/Brazil/128.124.199.35.bc.googleusercontent.com)
show less
SQL Injection
🇩🇪
4server
2026-06-15 04:45:09
(2 days ago)
[MonJun1506:45:06.6189512026][security2:error][pid3650296:tid3650314][client35.199.124.128:0]ModSecu ...
show more
[MonJun1506:45:06.6189512026][security2:error][pid3650296:tid3650314][client35.199.124.128:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:10\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"cbri.ch.136-243-54-122.cpanel.site\"][uri\"/portal/.git/config\"][unique_id\"ai-DUoZ-XF-x1qSNvze3LwAAAI8\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 04:38:23
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.199.124.128 (128.124.199.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.199.124.128 (128.124.199.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:38:17.472876 2026] [security2:error] [pid 4662:tid 4662] [client 35.199.124.128:36452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "versahealthcare.versacardio.com"] [uri "/src/.git/config"] [unique_id "ai-BuZom20kY8ZfjCy6B6gAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-06-15 04:38:07
(2 days ago)
20 attempts against mh-misbehave-ban on ceres
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 03:03:03
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.199.124.128 (128.124.199.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.199.124.128 (128.124.199.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 23:02:58.778847 2026] [security2:error] [pid 1700:tid 1700] [client 35.199.124.128:36670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kitebeach.com"] [uri "/blog/.git/config"] [unique_id "ai9rYoUtU27SDBVezXHAIgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lnklnx
2026-06-15 02:27:31
(2 days ago)
www.lincolnclan.com:443 35.199.124.128 - - [14/Jun/2026:21:27:29 -0500] "GET /.git/config HTTP/1.1" ...
show more
www.lincolnclan.com:443 35.199.124.128 - - [14/Jun/2026:21:27:29 -0500] "GET /.git/config HTTP/1.1" 401 4079 "-" "Mozilla/5.0 (Linux; Android 4.4.4; Nexus 7 Build/KTU84P) AppleWebKit/537.36 (KHTML like Gecko) Chrome/36.0.1985.135 Safari/537.36"
...
show less
Web App Attack