🇮🇹
CoreTech srl
2026-11-08 21:48:56
UTC ·
(2 days ago)
cloudlinux2 fail2ban: 2026-11-08 22:44:43,252 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 104.244.227.141 - 2026-11-08 22:44:43cloudlinux2 fail2ban: 2026-11-08 22:45:09,498 fail2ban.filter [1672]: INFO [plesk-wordpress] ...
show more
cloudlinux2 fail2ban: 2026-11-08 22:44:43,252 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 104.244.227.141 - 2026-11-08 22:44:43cloudlinux2 fail2ban: 2026-11-08 22:45:09,498 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 201.106.33.79 - 2026-11-08 22:45:08cloudlinux2 fail2ban: 2026-11-08 22:45:57,471 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 99.237.133.158 - 2026-11-08 22:45:57cloudlinux2 fail2ban: 2026-11-08 22:45:53,187 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 151.34.237.250 - 2026-11-08 22:45:52cloudlinux2 fail2ban: 2026-11-08 22:46:53,703 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 22:46:53cloudlinux2 fail2ban: 2026-11-08 22:46:53,780 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 22:46:53cloudlinux2 fail2ban: 2026-11-08 22:46:53,758 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 22:46:5
show less
Web App Attack
🇧🇪
cmbplf
2026-11-08 20:28:10
UTC ·
(2 days ago)
169 requests with url.path */proc/*
123 requests with url.path *.php.bak
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 20:14:14
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.203.94.199 (199.94.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:14:08.280988 2026] [security2:error] [pid 1062251:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.94.199 (199.94.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:14:08.280988 2026] [security2:error] [pid 1062251:tid 1062305] [client 35.203.94.199:40818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gelatoconsapevole.it"] [uri "/images../.env"] [unique_id "avDYEAtOrXtGJk53w2lJpgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Zundapper
2026-11-08 20:14:08
UTC ·
(2 days ago)
35.203.94.199 - - [08/Nov/2026:21:14:05 +0100] "GET /sitemap.xml HTTP/2.0" 404 106 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.203.94.199 - - [08/Nov/2026:21:14:05 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 106 "-" "Mozilla/5. ...
show more
35.203.94.199 - - [08/Nov/2026:21:14:05 +0100] "GET /sitemap.xml HTTP/2.0" 404 106 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.203.94.199 - - [08/Nov/2026:21:14:05 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
35.203.94.199 - - [08/Nov/2026:21:14:08 +0100] "GET /yl93koyvo5blezgl29iq HTTP/2.0" 404 106 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.203.94.199 - - [08/Nov/2026:21:14:08 +0100] "GET /ngsw.json HTTP/2.0" 404 167 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
35.203.94.199 - - [08/Nov/2026:21:14:08 +0100] "GET /z9x8c7v6b5-debug-trigger-cnc-step.it HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
...
show less
Web App Attack
Port Scan
🇫🇷
Delta-shop
2026-11-08 19:54:44
UTC ·
(2 days ago)
PrestaShop Security Module: Suspicious path detected (/.env)
Web App Attack
🇳🇱
Alt255
2026-11-08 19:50:17
UTC ·
(2 days ago)
[cb-03al] Web exploit scanning: 6 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.203.94.199 - - [08/Nov/2026:20:50:07 +0100] "GET /static//app/.env HTTP/2.0" 403 350 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://ww ...
show more
[cb-03al] Web exploit scanning: 6 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.203.94.199 - - [08/Nov/2026:20:50:07 +0100] "GET /static//app/.env HTTP/2.0" 403 350 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-08 19:47:24
UTC ·
(2 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-11-08 19:46:28
UTC ·
(2 days ago)
(PERMBLOCK) 35.203.94.199 (CA/Canada/199.94.203.35.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
Port Scan
🇮🇹
CoreTech srl
2026-11-08 19:13:56
UTC ·
(2 days ago)
cloudlinux2 fail2ban: 2026-11-08 20:09:13,403 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 222.87.167.184 - 2026-11-08 20:09:13cloudlinux2 fail2ban: 2026-11-08 20:09:17,530 fail2ban.filter [1672]: INFO [plesk-modsecuri ...
show more
cloudlinux2 fail2ban: 2026-11-08 20:09:13,403 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 222.87.167.184 - 2026-11-08 20:09:13cloudlinux2 fail2ban: 2026-11-08 20:09:17,530 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 20:09:17cloudlinux2 fail2ban: 2026-11-08 20:09:17,493 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 20:09:17cloudlinux2 fail2ban: 2026-11-08 20:09:17,457 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 20:09:17cloudlinux2 fail2ban: 2026-11-08 20:09:17,807 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 20:09:17cloudlinux2 fail2ban: 2026-11-08 20:09:17,481 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 20:09:17cloudlinux2 fail2ban: 2026-11-08 20:09:17,727 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 35.203.94.199 - 2026-11-08 20
show less
Brute-Force
🇩🇪
updown.io
2026-11-08 19:09:16
UTC ·
(2 days ago)
{"level":"info","ts":1794164956.778741,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.203.94.199","remote_port":"51390","client_ip":"35.203.94.199","proto":"HTTP/2.0","method":"GET","host":"status.caponord.it","uri ...
show more
{"level":"info","ts":1794164956.778741,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.203.94.199","remote_port":"51390","client_ip":"35.203.94.199","proto":"HTTP/2.0","method":"GET","host":"status.caponord.it","uri":"/.firebaserc","headers":{"Accept":["*/*"],"X-Real-Ip":["10.197.157.112"],"True-Client-Ip":["10.197.157.112"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Remote-Ip":["10.197.157.112"],"Accept-Encoding":["gzip"],"X-Proxyuser-Ip":["10.197.157.112"],"Forwarded":["for=10.197.157.112"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"],"X-Client-Ip":["10.197.157.112"],"X-Remote-Addr":["10.197.157.112"],"X-Custom-Ip-Authorization":["10.197.157.112"],"X-Originating-Ip":["10.197.157.112"],"Cluster-Client-Ip"
...
show less
DDoS Attack
Web App Attack
🇩🇪
paissangroup
2026-11-08 17:37:21
UTC ·
(3 days ago)
Multiple WAF Violations
Web App Attack
🇬🇧
consul.to
2026-11-08 17:30:19
UTC ·
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
2026-11-08 16:58:17
UTC ·
(3 days ago)
35.203.94.199 - - [08/Nov/2026:17:57:57 +0100] "GET /.env HTTP/2.0" 403 293 "https://www.l1k.it/%2eenv" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
Web Spam
Blog Spam
Brute-Force
Web App Attack
🇫🇷
[email protected]
2026-11-08 16:25:26
UTC ·
(3 days ago)
PrestaShop Security Module: Suspicious path detected (/.env)
Web App Attack
🇮🇹
Inartis
2026-11-08 15:55:31
UTC ·
(3 days ago)
35.203.94.199 - - [08/Nov/2026:16:50:27 +0100] "POST /api/graphql HTTP/2.0" 404 0 "https://blog.neroniane.it" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
...
Brute-Force
Bad Web Bot
Web App Attack
