🇩🇪
rh24
2026-10-01 15:18:59
(6 hours ago)
(badbots) Bad bot user-agent [redacted] from 35.204.85.231 (231.85.204.35.bc.googleusercontent.com)
Hacking
🇺🇸
TPI-Abuse
2026-10-01 15:01:35
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.204.85.231 (231.85.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.85.231 (231.85.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:01:32.563695 2026] [security2:error] [pid 18646:tid 18646] [client 35.204.85.231:52224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.richardpastor.com.jpastorphotographics.com"] [uri "/media../.env"] [unique_id "ar51zGif4-Rb6ZnMI8D3uAAAADs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-01 15:01:35
(7 hours ago)
[mx01aln] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[mx01aln] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.204.85.231 - - [01/Oct/2026:17:01:35 +0200] "GET /.htpasswd HTTP/2.0" 403 2007 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
35.204.85.231 - - [01/Oct/2026:17:01:35 +0200] "GET /.ssh/id_ed25519 HTTP/2.0" 404 2004 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 14:20:41
(7 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.204.85.231 (231.85.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.204.85.231 (231.85.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:20:35.974066 2026] [security2:error] [pid 31363:tid 31363] [client 35.204.85.231:50856] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||daisydoesoap.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "daisydoesoap.com"] [uri "/z9x8c7v6b5-debug-trigger-daisydoesoap.com"] [unique_id "ar5sMyg_YFvzJV1uu2uZ9QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 14:03:15
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.204.85.231 (231.85.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.204.85.231 (231.85.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:03:09.409703 2026] [security2:error] [pid 25281:tid 25281] [client 35.204.85.231:37156] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rmjaero.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rmjaero.com"] [uri "/z9x8c7v6b5-debug-trigger-rmjaero.com"] [unique_id "ar5oHckmFP8EjUuL4uhrewAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
René Hickersberger
2026-10-01 13:54:59
(8 hours ago)
malicious bot detected: violations="ignored-robots-policy"; user_agent="Mozilla/5.0 (compatible; Kim ...
show more
malicious bot detected: violations="ignored-robots-policy"; user_agent="Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
show less
Bad Web Bot
🇳🇱
Savvii
2026-10-01 13:45:49
(8 hours ago)
20 attempts against mh-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-01 13:45:03
(8 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-10-01 13:40:56
(8 hours ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇸🇬
khairilgunawan
2026-10-01 13:29:30
(8 hours ago)
ZonaKuota Sentinel: Malicious automated scanner/exploit probe trapped. Blocked.
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-01 13:20:36
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.204.85.231 (231.85.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.85.231 (231.85.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:20:31.224734 2026] [security2:error] [pid 15836:tid 15836] [client 35.204.85.231:51882] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.romestudios.com"] [uri "/.env.js"] [unique_id "ar5eH2JA5fDPlKQNl94l2AAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-01 13:19:37
(8 hours ago)
Multiple WAF Violations
Web App Attack
2026-10-01 13:15:00
(8 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
2026-10-01 13:10:09
(8 hours ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇳🇱
Savvii
2026-10-01 13:07:11
(8 hours ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
