🇧🇷
ICS Labs
2026-10-15 13:45:10
(6 days ago)
ICS Labs threat intelligence (ICS Feeds): Port Scan, Brute-Force. Last observed 2026-10-15 UTC.
Port Scan
Brute-Force
🇺🇸
TPI-Abuse
2026-10-14 18:54:45
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 14:54:37.473549 2026] [security2:error] [pid 13212:tid 13212] [client 35.221.125.183:35974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.gabbyspetnanny.com"] [uri "/images../.env"] [unique_id "as_P7UPDurYdJrC4YXqzngAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 18:26:18
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 14:26:11.832280 2026] [security2:error] [pid 19389:tid 19389] [client 35.221.125.183:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.frogmouthatx.com"] [uri "/static//app/.env"] [unique_id "as_JQyqJdmhAG3hcrBbEAAAAADs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-14 18:05:02
(1 week ago)
suspicious request in access.log
Web App Attack
🇩🇪
rh24
2026-10-14 17:26:32
(1 week ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.221.125.183 (JP/J ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.221.125.183 (JP/Japan/183.125.221.35.bc.googleusercontent.com): (CF_ENABLE)
show less
Bad Web Bot
🇿🇦
conure.sh
2026-10-14 17:12:26
(1 week ago)
csagent: score 22.5: 404 noise floor x10, secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 17:07:28
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 13:07:23.233964 2026] [security2:error] [pid 26627:tid 26627] [client 35.221.125.183:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.grainavi.com"] [uri "/files../.env"] [unique_id "as-2y3BTms_YqHj2zRhT6wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 16:33:31
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:33:24.643197 2026] [security2:error] [pid 6561:tid 6624] [client 35.221.125.183:34980] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gabegabel.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gabegabel.com"] [uri "/z9x8c7v6b5-debug-trigger-gabegabel.com"] [unique_id "as-u1H9Q2-tabeTsGk43HgAAAUE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-14 15:56:08
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇲🇾
Rizzy
2026-10-14 15:15:30
(1 week ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-10-14 14:14:02
(1 week ago)
{"level":"info","ts":1791987239.9567902,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791987239.9567902,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.221.125.183","remote_port":"33714","client_ip":"35.221.125.183","proto":"HTTP/2.0","method":"GET","host":"status.unit27.co.uk","uri":"/assets/manifest.json","headers":{"Sec-Fetch-Mode":["no-cors"],"Priority":["u=1"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept":["*/*"],"Sec-Fetch-Dest":["script"],"X-Nextjs-Data":["1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Ch-Ua-Mobile":["?0"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Accept-Language":["en-US,en;q=0.9"],"Sec-Fetch-Site":["same-origin"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""]},"tls":{"r
...
show less
DDoS Attack
Web App Attack
🇺🇸
floreriaexpress
2026-10-14 13:31:58
(1 week ago)
FakeADS-Anti: fake_bot:fake_googlebot | https://mail.floreriaexpresschile.cl/jrtoa1ud5o6h32o5xkav
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 13:31:47
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.125.183 (183.125.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 09:31:41.809309 2026] [security2:error] [pid 7367:tid 7367] [client 35.221.125.183:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.enperth.org"] [uri "/static//.env"] [unique_id "as-EPVf_pRml8mr9YJvVVQAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-14 12:43:02
(1 week ago)
csagent: score 23.0: 404 noise floor x12, secrets grab x2; 1 domain(s) in 1s
Web App Attack
🇫🇷
dynamix
2026-10-14 11:40:19
(1 week ago)
Multiple WAF Violations
Web App Attack