🇺🇸
iwle
2026-11-12 04:10:12
UTC ·
(1 day ago)
[Wed Nov 11 23:10:10.028137 2026] [:error] [pid 488806:tid 488852] [client 35.202.204.183:45628] [client 35.202.204.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo( ...
show more
[Wed Nov 11 23:10:10.028137 2026] [:error] [pid 488806:tid 488852] [client 35.202.204.183:45628] [client 35.202.204.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "www.app.iwle.com"] [uri "/.env"] [unique_id "avU8Io3Ko5EfSc62HGiGbQAAAVI"]
[Wed Nov 11 23:10:10.187374 2026] [:error] [pid 714091:tid 714127] [client 35.202.204.183:45640] [client 35.202.204.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\
...
show less
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-11-11 23:08:01
UTC ·
(1 day ago)
Bad behaviour
Web Spam
🇩🇪
wpadm4
2026-11-10 18:18:27
UTC ·
(2 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇳🇱
e.fierstra
2026-11-10 09:24:42
UTC ·
(3 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-10 08:18:29
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: www.definitelynotahoneypot.online | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: www.definitelynotahoneypot.online | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇩🇪
FD-IX
2026-11-10 05:53:32
UTC ·
(3 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-11-10 05:13:27
UTC ·
(3 days ago)
Malicious web traffic detected by CrowdSec
Hacking
🇬🇧
consul.to
2026-11-10 05:02:41
UTC ·
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
2026-11-10 02:10:06
UTC ·
(3 days ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-09 22:58:47
UTC ·
(3 days ago)
8.536 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇳🇱
Alt255
2026-11-09 22:50:18
UTC ·
(3 days ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.202.204.183 - - \[09/Nov/2026:23:50:14 +0100\] "GET /.git/config HTTP/1.1" 404 573 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.202.204.183 - - \[09/Nov/2026:23:50:14 +0100\] "GET /.git/config HTTP/1.1" 404 573 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-11-09 22:19:13
UTC ·
(3 days ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-09 17:46:15
UTC ·
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇬🇧
poundawebsiteltd
2026-11-09 16:39:32
UTC ·
(3 days ago)
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 35.202.204.183 (US/United States/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 35.202.204.183 (US/United States/183. ...
show more
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 35.202.204.183 (US/United States/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 35.202.204.183 (US/United States/183.204.202.35.bc.googleusercontent.com): 20 in the last 3600 secs
show less
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-09 16:37:23
UTC ·
(3 days ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.202.204.183 - - [09/Nov/2026:17:37:18 +0100] "GET /.git/config HTTP/1.1" 301 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWeb ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.202.204.183 - - [09/Nov/2026:17:37:18 +0100] "GET /.git/config HTTP/1.1" 301 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
