🇧🇪
sid3windr
2026-06-17 06:03:34
(1 day ago)
GET /config/.aws/credentials (Tarpitted for 1d15h8m28s, wasted 8.06MB)
Web App Attack
🇧🇪
sid3windr
2026-06-15 18:20:55
(3 days ago)
GET /config/keys.json (Tarpitted for , wasted 120B)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 18:18:06
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 35.199.78.47 (47.78.199.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.199.78.47 (47.78.199.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 14:18:01.615089 2026] [security2:error] [pid 15753:tid 15753] [client 35.199.78.47:50030] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||whatyouhear.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "whatyouhear.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "ajBB2dTtm_wSvouzTelNAAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Antinson
2026-06-15 14:05:51
(3 days ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇺🇸
JustMeHere
2026-06-15 10:57:27
(3 days ago)
[Mon Jun 15 06:57:20.894876 2026] [security2:error] [pid 178390:tid 178433] [client 35.199.78.47:336 ...
show more
[Mon Jun 15 06:57:20.894876 2026] [security2:error] [pid 178390:tid 178433] [client 35.199.78.47:33634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "c-73-88-79-72.hsd1.sc.comcast.net"] [uri "/.aws/credentials"] [unique_id "ai_akIunTra4QIU6o8U74QAAAQ8"]
...
show less
Web App Attack
🇳🇱
Site.eu
2026-06-15 09:31:06
(3 days ago)
Excessive 404/403 errors
Brute-Force
🇫🇷
masterguru
2026-06-15 08:15:27
(3 days ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-196)
Hacking
Web App Attack
🇺🇸
mnsf
2026-06-15 00:09:31
(3 days ago)
Scanning/Probing (62)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:48:11
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.199.78.47 (47.78.199.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.199.78.47 (47.78.199.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:48:06.588926 2026] [security2:error] [pid 5670:tid 5670] [client 35.199.78.47:35530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gdcservices.com"] [uri "/app/.env.prod"] [unique_id "ai89tu77WJm3N17ITv2lDgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 22:50:29
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.199.78.47 (47.78.199.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.199.78.47 (47.78.199.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 18:50:23.424392 2026] [security2:error] [pid 24195:tid 24195] [client 35.199.78.47:35218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "killeenbarrelsandtotes.com"] [uri "/app/.env.local"] [unique_id "ai8wL_YCDXPsrBI3Fd-CxQAAAGs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-06-14 22:20:53
(3 days ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-06-14 12:14:47
(4 days ago)
83 attempts against mh-misbehave-ban on twig
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-06-14 05:15:04
(4 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
2026-06-14 02:16:18
(4 days ago)
(caddyscan) Scanner path probe from 35.199.78.47 (BR/Brazil/47.78.199.35.bc.googleusercontent.com): ...
show more
(caddyscan) Scanner path probe from 35.199.78.47 (BR/Brazil/47.78.199.35.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 35.199.78.47 - - [14/Jun/2026:02:16:00 +0000] "GET /development/.env HTTP/1.1"
[REDACTED] 200 2627 35.199.78.47 - - [14/Jun/2026:02:16:00 +0000] "GET /services/.env HTTP/1.1"
[REDACTED] 200 2627 35.199.78.47 - - [14/Jun/2026:02:16:00 +0000] "GET /api/v3/.env HTTP/1.1"
[REDACTED] 200 2627 35.199.78.47 - - [14/Jun/2026:02:16:00 +0000] "GET /.env.dev.local HTTP/1.1"
[REDACTED] 200 2627 35.199.78.47 - - [14/Jun/2026:02:16:00 +0000] "GET /admin/.env.production HTTP/1.1"
show less
Port Scan