🇩🇪
maxpower
2026-10-12 22:03:53
(12 minutes ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 35.200.42.80 (JP/Japan/80.42.200.35.bc.g ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 35.200.42.80 (JP/Japan/80.42.200.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.200.42.80 - - [13/Oct/2026:00:03:48 +0200] "GET /secrets.json HTTP/2.0" 200 4803 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" "35.200.42.80" host=staging.villapardi.it
show less
Port Scan
🇳🇱
e.fierstra
2026-10-12 21:51:59
(24 minutes ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-10-12 21:02:33
(1 hour ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-10-12 17:02:18
(5 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-12 16:28:44
(5 hours ago)
(mod_security) mod_security (id:949110) triggered by 35.200.42.80 (80.42.200.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:949110) triggered by 35.200.42.80 (80.42.200.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:28:37.355558 2026] [security2:error] [pid 3116:tid 3116] [client 35.200.42.80:57432] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.ironmountainsports.com"] [uri "/images../.env"] [unique_id "as0KtTTRm6XRsK9l7lIKogAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-12 16:22:15
(5 hours ago)
(mod_security) mod_security (id:949110) triggered by 35.200.42.80 (JP/Japan/80.42.200.35.bc.googleus ...
show more
(mod_security) mod_security (id:949110) triggered by 35.200.42.80 (JP/Japan/80.42.200.35.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇩🇪
Petros Stefanakis
2026-10-12 16:20:34
(5 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 35.200.42.80 (JP/Japan/80.42.200.35.bc. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.200.42.80 (JP/Japan/80.42.200.35.bc.googleusercontent.com)
show less
SQL Injection
2026-10-12 14:39:47
(7 hours ago)
Aggressive web scan
Web App Attack
🇺🇸
Operator873
2026-10-12 14:38:39
(7 hours ago)
2026/10/12 09:38:36 [error] 734114#0: *1397101 access forbidden by rule, client: 35.200.42.80, serve ...
show more
2026/10/12 09:38:36 [error] 734114#0: *1397101 access forbidden by rule, client: 35.200.42.80, server: [OBFUSCATED], request: "GET / HTTP/1.1", host: "irc.n5txl.com"
2026/10/12 09:38:36 [error] 734114#0: *1397101 access forbidden by rule, client: 35.200.42.80, server: [OBFUSCATED], request: "GET / HTTP/1.1", host: "irc.n5txl.com"
2026/10/12 09:38:36 [error] 734114#0: *1397101 access forbidden by rule, client: 35.200.42.80, server: [OBFUSCATED], request: "GET /robots.txt HTTP/1.1", host: "irc.n5txl.com"
2026/10/12 09:38:36 [error] 734114#0: *1397101 access forbidden by rule, client: 35.200.42.80, server: [OBFUSCATED], request: "GET /robots.txt HTTP/1.1", host: "irc.n5txl.com"
2026/10/12 09:38:36 [error] 734114#0: *1397101 access forbidden by rule, client: 35.200.42.80, server: [OBFUSCATED], request: "GET /5256nppjdn3kq7xnk0fx HTTP/1.1", host: "irc.n5txl.com"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 14:09:15
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.200.42.80 (80.42.200.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.200.42.80 (80.42.200.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:09:11.366164 2026] [security2:error] [pid 25333:tid 25333] [client 35.200.42.80:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ipv6.c2cservices.com|F|2"] [data ".c2cservices.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ipv6.c2cservices.com"] [uri "/z9x8c7v6b5-debug-trigger-ipv6.c2cservices.com"] [unique_id "aszqB4jF1BO6lVuEqDfq7QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-10-12 14:07:03
(8 hours ago)
Bad behaviour
Web Spam
🇫🇷
LiloBzH
2026-10-12 14:04:47
(8 hours ago)
35.200.42.80 - - [12/Oct/2026:16:04:46 +0200] "GET /.git/config HTTP/2.0" 403 107 "-" "Mozilla/5.0 A ...
show more
35.200.42.80 - - [12/Oct/2026:16:04:46 +0200] "GET /.git/config HTTP/2.0" 403 107 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
show less
Web App Attack
🇩🇪
Bedios GmbH
2026-10-12 14:03:49
(8 hours ago)
Login credentials theft attempt
Hacking
2026-10-12 14:01:55
(8 hours ago)
Unauthorized server file access attempt.
Hacking
🇫🇷
LiloBzH
2026-10-12 09:36:04
(12 hours ago)
35.200.42.80 - - [12/Oct/2026:11:36:02 +0200] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+ ...
show more
35.200.42.80 - - [12/Oct/2026:11:36:02 +0200] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 1745 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
35.200.42.80 - - [12/Oct/2026:11:36:02 +0200] "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 1742 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
show less
Web App Attack
