🇳🇱
homeshowdomain.nl
2026-08-27 21:59:39
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-26.
show less
Web App Attack
SSH
Hacking
🇮🇳
evicky2002
2026-08-27 06:00:33
(3 days ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇩🇪
reznekcs
2026-08-27 05:02:57
(4 days ago)
Blocked by UFW firewall
Brute-Force
🇳🇱
homeshowdomain.nl
2026-08-26 21:59:16
(4 days ago)
Auto-ban: >3000 req/min op 2026-08-26
Web App Attack
SSH
Hacking
🇧🇷
Halux
2026-08-26 19:08:11
(4 days ago)
35.204.81.243 Probing protected path or service
Web App Attack
🇩🇪
big-cloud.nl
2026-08-26 17:43:50
(4 days ago)
Try to access /@fs/home/ec2-user/.aws/credentials?raw??
Web App Attack
🇳🇱
ConsulHosting
2026-08-26 15:27:30
(4 days ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇫🇷
masterguru
2026-08-26 15:19:10
(4 days ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇫🇷
Octopuce
2026-08-26 15:14:22
(4 days ago)
Aggressive web search of vulnerable pages: /media../.env /.env /static../.env /api/.env /server/.env ...
show more
Aggressive web search of vulnerable pages: /media../.env /.env /static../.env /api/.env /server/.env ...
show less
Web App Attack
🇳🇱
Site.eu
2026-08-26 15:09:43
(4 days ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TAY
2026-08-26 14:48:51
(4 days ago)
35.204.81.243 - - [26/Aug/2026:22:48:48 +0800] "GET /assets../../../etc/passwd HTTP/1.1" 301 466 "-" ...
show more
35.204.81.243 - - [26/Aug/2026:22:48:48 +0800] "GET /assets../../../etc/passwd HTTP/1.1" 301 466 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; [email protected] )"
35.204.81.243 - - [26/Aug/2026:22:48:48 +0800] "GET /media../etc/passwd HTTP/1.1" 301 455 "-" "Mozilla/5.0 (compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchbot)"
35.204.81.243 - - [26/Aug/2026:22:48:49 +0800] "GET /@fs/../.env?raw?? HTTP/1.1" 301 439 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.7) Gecko/20100101 Firefox/105.7; compatible; Slackbot-LinkExpanding/1.0; +https://api.slack.com/robots"
35.204.81.243 - - [26/Aug/2026:22:48:50 +0800] "GET /download?file=../../../../etc/passwd HTTP/1.1" 301 491 "-" "Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.7554.207 Mobile Safari/537.36; compatible; Twitterbot/1.0"
35.204.81.243 - - [26/Aug/2026:22:48:50 +0800] "GET /?file=../../../../etc/passwd HTTP/1.1" 301 475 "-" "Mozilla/5.0 AppleWebKit/537
...
show less
Brute-Force
🇺🇦
Olexiy Backend
2026-08-26 14:24:33
(4 days ago)
35.204.81.243
...
Bad Web Bot
Web App Attack
2026-08-26 13:55:10
(4 days ago)
35.204.81.243 - - [26/Aug/2026:15:54:53 +0200] "GET /.env.local HTTP/1.1" 403 4460 "-" "Mozilla/5.0 ...
show more
35.204.81.243 - - [26/Aug/2026:15:54:53 +0200] "GET /.env.local HTTP/1.1" 403 4460 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Slackbot-LinkExpanding/1.0; +https://api.slack.com/robots)"
show less
Web Spam
Blog Spam
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 13:43:28
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 35.204.81.243 (243.81.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.81.243 (243.81.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 09:43:23.309252 2026] [security2:error] [pid 23644:tid 23644] [client 35.204.81.243:59916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildrosestudios.tv"] [uri "/.git/HEAD"] [unique_id "ao7te7e4XeVcmwrvctkiRgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 12:13:48
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 35.204.81.243 (243.81.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.81.243 (243.81.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 08:13:42.326293 2026] [security2:error] [pid 31398:tid 31398] [client 35.204.81.243:25864] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "balmedia.com"] [uri "/@fs/../.env"] [unique_id "ao7Ydl5bIuxEa5yuQJVFzAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack