Anonymous
2026-11-06 20:06:06
UTC ·
(3 hours ago)
Trying to access config files
Web App Attack
Anonymous
2026-11-06 18:59:31
UTC ·
(4 hours ago)
35.201.197.114 - - [06/Nov/2026:19:59:29 +0100] "GET /.htpasswd HTTP/2.0" 403 272 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
35.201.197.114 - - [06/Nov/2026:19:59:30 +0100] "GET /appearance/../../.env HT ...
show more
35.201.197.114 - - [06/Nov/2026:19:59:29 +0100] "GET /.htpasswd HTTP/2.0" 403 272 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
35.201.197.114 - - [06/Nov/2026:19:59:30 +0100] "GET /appearance/../../.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)"
35.201.197.114 - - [06/Nov/2026:19:59:30 +0100] "GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F..%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
35.201.197.114 - - [06/Nov/2026:19:59:30 +0100] "GET /appearance/../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
35.201.197.114 - - [06/Nov/2026:19:59:30 +0100] "GET /static/../../../a/../../../../.env HTTP/2.0" 400 295 "-" "CCBot/2.0 (https://commoncrawl
...
show less
Brute-Force
SSH
🇳🇱
Savvii
2026-11-06 18:34:29
UTC ·
(5 hours ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 16:36:29
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.201.197.114 (114.197.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 11:36:24.699371 2026] [security2:error] [pid 5864:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.201.197.114 (114.197.201.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 11:36:24.699371 2026] [security2:error] [pid 5864:tid 5864] [client 35.201.197.114:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.365soft.top"] [uri "/.env.supabase"] [unique_id "au4CCPtfFQJiHedBcu-gqgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-06 16:01:58
UTC ·
(7 hours ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇩🇪
Séfora Srl
2026-11-06 15:37:09
UTC ·
(8 hours ago)
crowdsecurity/http-sensitive-files detected by CrowdSec
Web App Attack
Anonymous
2026-11-06 15:12:19
UTC ·
(8 hours ago)
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTT ...
show more
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.201.197.114 - - [06/Nov/2026:16:12:18 +0100] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Brute-Force
SSH
🇳🇱
Savvii
2026-11-06 15:04:37
UTC ·
(8 hours ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-06 14:49:26
UTC ·
(8 hours ago)
Aggressive web scan
Web App Attack
🇬🇧
kie
2026-11-06 14:42:48
UTC ·
(8 hours ago)
06-11-2026:14:42:38UTC [Nginx Web Server] Suspicious web request: path:/.env path:/wp-config path:/.env,/.git (147 request(s)).
Bad Web Bot
Web App Attack
🇬🇧
noise.agency
2026-11-06 14:35:19
UTC ·
(9 hours ago)
35.201.197.114 (TW/Taiwan/114.197.201.35.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
Anonymous
2026-11-06 14:13:46
UTC ·
(9 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Alboweb B.V.
2026-11-06 14:11:05
UTC ·
(9 hours ago)
Bad web bot activity detected by Fail2Ban in plesk-apache-badbot jail
Bad Web Bot
Anonymous
2026-11-06 14:04:55
UTC ·
(9 hours ago)
35.201.197.114 - - [06/Nov/2026:15:04:51 +0100] "GET /.htpasswd HTTP/2.0" 403 272 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
35.201.197.114 - - [06/Nov/2026:15:04:54 +0100] "GET /appearance/../../.env HTTP/2.0" 400 295 "-" "Mozilla/5 ...
show more
35.201.197.114 - - [06/Nov/2026:15:04:51 +0100] "GET /.htpasswd HTTP/2.0" 403 272 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
35.201.197.114 - - [06/Nov/2026:15:04:54 +0100] "GET /appearance/../../.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
35.201.197.114 - - [06/Nov/2026:15:04:54 +0100] "GET /static/../../../a/../../../../.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
35.201.197.114 - - [06/Nov/2026:15:04:54 +0100] "GET /appearance/../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
35.201.197.114 - - [06/Nov/2026:15:04:54 +0100] "GET /static/../../../a/../../../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
...
show less
Brute-Force
SSH
🇮🇹
VHosting
2026-11-06 13:40:04
UTC ·
(9 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack