2026-10-02 06:45:16
UTC ·
(1 month ago)
LogGuard auto-report | score=135 | flags=flood | reasons=[+35] burst_10s_hard: 251 req in 10s (threshold 100); [+20] burst_60s_suspicious: 251 req in 60s (threshold 200); [+20] burst_60s_suspicious: 251 req in 60s (threshold 200); [+10] error_ratio_s ...
show more
LogGuard auto-report | score=135 | flags=flood | reasons=[+35] burst_10s_hard: 251 req in 10s (threshold 100); [+20] burst_60s_suspicious: 251 req in 60s (threshold 200); [+20] burst_60s_suspicious: 251 req in 60s (threshold 200); [+10] error_ratio_suspicious: 73% error rate in 60s (182/251); [+25] path_diversity_severe: 213 unique paths in 60s (threshold 50)
show less
DDoS Attack
🇺🇸
TPI-Abuse
2026-10-02 06:14:58
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 02:14:54.726240 2026] [security2:error] [pid 13908:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 02:14:54.726240 2026] [security2:error] [pid 13908:tid 13908] [client 35.203.19.200:41672] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||anneoday.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "anneoday.com"] [uri "/z9x8c7v6b5-debug-trigger-anneoday.com"] [unique_id "ar9L3jWQJbmBNO-m9DDSdwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Major Hostility
2026-10-02 06:13:03
UTC ·
(1 month ago)
"GET /z9x8c7v6b5-debug-trigger-[DOMAIN] HTTP/1.1" 404
"GET /webpack-stats.json HTTP/1.1" 404
"GET /kowix82a2fja9gyz62z7 HTTP/1.1" 404
"POST /lib/terminal-xhr.php HTTP/1.1" 404
"GET /assets/manifest.json HTTP/1.1" 404
"GET /model/info HTTP/1.1" 404
"G ...
show more
"GET /z9x8c7v6b5-debug-trigger-[DOMAIN] HTTP/1.1" 404
"GET /webpack-stats.json HTTP/1.1" 404
"GET /kowix82a2fja9gyz62z7 HTTP/1.1" 404
"POST /lib/terminal-xhr.php HTTP/1.1" 404
"GET /assets/manifest.json HTTP/1.1" 404
"GET /model/info HTTP/1.1" 404
"GET /vmd0h8nynuax99fofgmv HTTP/1.1" 404
"GET /dist/manifest.json HTTP/1.1" 404
"GET /asset-manifest.json HTTP/1.1" 404
"GET /manifest.json HTTP/1.1" 404
"GET /static/manifest.json HTTP/1.1" 404
"POST /graphql HTTP/1.1" 404
"POST /icecoder/lib/terminal-xhr.php HTTP/1.1" 404
"GET /model/info HTTP/1.1" 404
"GET /dist../.env HTTP/1.1" 404
"GET /static../.env HTTP/1.1" 404
"GET /wp-json HTTP/1.1" 404
"GET /media../.env HTTP/1.1" 404
"PO
show less
Web App Attack
🇮🇹
paoloartone
2026-10-02 05:00:22
UTC ·
(1 month ago)
Reverse proxy TCO: 1422 richieste malevole bloccate (scan/exploit/brute-force WordPress) il 01/10/2026.
Web App Attack
Hacking
Port Scan
🇩🇪
gadix
2026-10-02 02:09:04
UTC ·
(1 month ago)
[02/Oct/2026:04:09:03.136544 +0200] ar8SPzNkXMPcjFVHNnaV-QAAAEY 35.203.19.200 56702 127.0.0.1 7081
[02/Oct/2026:04:09:03.633369 +0200] ar8SPzNkXMPcjFVHNnaWBAAAAEg 35.203.19.200 56954 127.0.0.1 7081
[0
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 01:28:42
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 21:28:35.734237 2026] [security2:error] [pid 16202:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 21:28:35.734237 2026] [security2:error] [pid 16202:tid 16202] [client 35.203.19.200:33480] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thewarmachineguns.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thewarmachineguns.com"] [uri "/z9x8c7v6b5-debug-trigger-thewarmachineguns.com"] [unique_id "ar8IwzfRBY5aPnVoGxxnmwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-10-02 00:45:18
UTC ·
(1 month ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-02 00:37:44
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 20:37:38.117218 2026] [security2:error] [pid 26100:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 20:37:38.117218 2026] [security2:error] [pid 26100:tid 26136] [client 35.203.19.200:35638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.annaly.org"] [uri "/.env.php.bak"] [unique_id "ar780s_saYzJPKEHAvVjAgAAAJQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-02 00:04:21
UTC ·
(1 month ago)
2.901 requests from abuseipdb.com blacklisted IP (1yr6mos3w)
Brute-Force
Bad Web Bot
🇫🇷
ecode hosting
2026-10-01 20:40:06
UTC ·
(1 month ago)
Domain : anahtarhastanesi.com
Rule : env
2026-10-01 20:37:51 10.100.1.20 GET /media../.env - 443 - 35.203.19.200 HTTP/2 Mozilla/5.0 (compatible; cohere-ai; https://cohere.com/crawler) - anahtarhastanesi.com 301 0 0 167 407 146 - -
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-10-01 19:45:44
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 15:45:39.063979 2026] [security2:error] [pid 11366:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 35.203.19.200 (200.19.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 15:45:39.063979 2026] [security2:error] [pid 11366:tid 11366] [client 35.203.19.200:60476] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||angeltarrac.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "angeltarrac.com"] [uri "/z9x8c7v6b5-debug-trigger-angeltarrac.com"] [unique_id "ar64Y-O8Jmt0wJL3BGHltgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-10-01 19:25:47
UTC ·
(1 month ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇩🇪
bazter.pro
2026-10-01 17:38:46
UTC ·
(1 month ago)
Fail2Ban: plesk-bot-aggressive - 15 failures
Port Scan
Bad Web Bot
Web App Attack
🇺🇸
grassyloki
2026-10-01 16:38:00
UTC ·
(1 month ago)
Web application attack against the public web tier; IDS flagged a Next.js Middleware Authorization Bypass (CVE-2025-29927) probe, all responses HTTP 444 (nothing served).
Target: HTTP 80 public web tier (www.angrysysadmins.tech); Next.js middleware a ...
show more
Web application attack against the public web tier; IDS flagged a Next.js Middleware Authorization Bypass (CVE-2025-29927) probe, all responses HTTP 444 (nothing served).
Target: HTTP 80 public web tier (www.angrysysadmins.tech); Next.js middleware auth-bypass probe (CVE-2025-29927) plus .env/webshell-file probing
Seen: 2026-10-01 12:38 EDT
- 2026-10-01 12:38:43 — IDS Web Application Attack [1:2061026:1] ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) from 35.203.19.200 targeting HTTP 80 on the public web tier
- 2026-10-01 12:38:43 — GET / HTTP/1.1 -> HTTP 444 (connection closed, no response served) on www.angrysysadmins.tech
show less
Web App Attack
Bad Web Bot
🇨🇦
Anytech
2026-10-01 16:34:16
UTC ·
(1 month ago)
Blocked by Conn-Monitor: env-probing
Web App Attack
Hacking
