2026-09-21 06:24:17
(1 day ago)
35.201.172.112 - - [20/Sep/2026:10:24:01 -0500] "GET /.env.bak HTTP/1.1" 301 269 "-" "Mozilla/5.0 (c ...
show more
35.201.172.112 - - [20/Sep/2026:10:24:01 -0500] "GET /.env.bak HTTP/1.1" 301 269 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 172.69.221.176
35.201.172.112 - - [20/Sep/2026:10:24:02 -0500] "GET /.env.example HTTP/1.1" 301 273 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)" 172.69.221.175
35.201.172.112 - - [20/Sep/2026:10:24:02 -0500] "GET /.env.local HTTP/1.1" 301 271 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 172.69.221.175
35.201.172.112 - - [20/Sep/2026:10:24:03 -0500] "GET /.env.js HTTP/1.1" 301 268 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)" 162.158.243.155
35.201.172.112 - - [20/Sep/2026:10:24:06 -0500] "GET /.env.save HTTP/1.1" 301 270 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)" 172.69.221.175
35.201.172.112 - - [20/Sep/2026:10:24:06 -0500] "GET /.env.
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 15:31:04
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 11:30:59.647523 2026] [security2:error] [pid 11255:tid 11280] [client 35.201.172.112:54796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rbarw.com"] [uri "/.git/HEAD"] [unique_id "aq_8M_gzif9WxphzZ7RCwwAAAVQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 15:12:16
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 11:12:11.253884 2026] [security2:error] [pid 3247:tid 3247] [client 35.201.172.112:58522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "raynernet.com"] [uri "/admin/.env"] [unique_id "aq_3y5UeINh3b0CG_OHbNAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 14:51:38
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:51:32.802777 2026] [security2:error] [pid 16363:tid 16435] [client 35.201.172.112:55456] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rawhabitat.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rawhabitat.com"] [uri "/rclone.conf"] [unique_id "aq_y9AhP2Ec8aTqJGSvjmQAAAhA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-20 14:49:35
(2 days ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-197)
show less
Bad Web Bot
🇮🇹
VHosting
2026-09-20 14:35:03
(2 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 14:28:31
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:28:26.157252 2026] [security2:error] [pid 24720:tid 24720] [client 35.201.172.112:39780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pappakotis.com"] [uri "/.env.js"] [unique_id "aq_tio9UB7bbpGDZIV-ougAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 14:03:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:03:50.013095 2026] [security2:error] [pid 10867:tid 10867] [client 35.201.172.112:50426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mikeneame.com"] [uri "/.env.js"] [unique_id "aq_nxjR2I_QFn4WmMG8u8wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-20 13:59:53
(2 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
lnklnx
2026-09-20 13:49:39
(2 days ago)
www.lnklnx.com:443 35.201.172.112 - - [20/Sep/2026:08:49:34 -0500] "GET /infra/.env HTTP/1.1" 403 49 ...
show more
www.lnklnx.com:443 35.201.172.112 - - [20/Sep/2026:08:49:34 -0500] "GET /infra/.env HTTP/1.1" 403 499 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 13:25:17
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:949110) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 09:25:12.524298 2026] [security2:error] [pid 21320:tid 21320] [client 35.201.172.112:33192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "joycepelham.com"] [uri "/z9x8c7v6b5-debug-trigger-joycepelham.com"] [unique_id "aq_euNNuSMn3b1Avd_6jjQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
itsolon
2026-09-20 13:17:27
(2 days ago)
[20/Sep/2026:15:17:26 +0200] 178991024625.136057 35.201.172.112 48232 217.154.7.177 443
[20/Sep/2026 ...
show more
[20/Sep/2026:15:17:26 +0200] 178991024625.136057 35.201.172.112 48232 217.154.7.177 443
[20/Sep/2026:15:17:26 +0200] 178991024691.640326 35.201.172.112 48232 217.154.7.177 443
[20/Sep/2026:15:17:26 +0200] 178991024611.991691 35.201.172.112 48232 217.154.7.177 443
[20/Sep/2026:15:17:26 +0200] 178991024632.198473 35.201.172.112 48232 217.154.7.177 443
[20/Sep/2026:15:17:27 +0200] 178991024768.198745 35.201.172.112 48220 217.154.7.177 443
...
show less
Port Scan
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 11:48:53
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 07:48:45.728893 2026] [security2:error] [pid 4404:tid 4404] [client 35.201.172.112:55428] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||daisydoesoap.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "daisydoesoap.com"] [uri "/z9x8c7v6b5-debug-trigger-daisydoesoap.com"] [unique_id "aq_IHX-p_-S9RoWcj9A6XgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 11:01:26
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.201.172.112 (112.172.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 07:01:18.786348 2026] [security2:error] [pid 18210:tid 18210] [client 35.201.172.112:56962] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||apfarrell.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "apfarrell.com"] [uri "/z9x8c7v6b5-debug-trigger-apfarrell.com"] [unique_id "aq-8_nFYTQJyqRG4j9wfaAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Blinker73
2026-09-20 11:01:21
(2 days ago)
35.201.172.112 - - [20/Sep/2026:07:01:20 -0400] "GET /.git-credentials HTTP/2.0" 403 107 "-" "Mozill ...
show more
35.201.172.112 - - [20/Sep/2026:07:01:20 -0400] "GET /.git-credentials HTTP/2.0" 403 107 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
show less
Bad Web Bot
Web App Attack
