2026-09-21 20:07:06
(1 month ago)
Automated web scanner. Requested suspicious paths: /api/config | /config.json. UTC: 2026-09-21 20:01 ...
show more
Automated web scanner. Requested suspicious paths: /api/config | /config.json. UTC: 2026-09-21 20:01:51.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 17:09:16
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:09:09.222405 2026] [security2:error] [pid 27924:tid 27924] [client 35.221.140.59:42318] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.villamarehiltonhead.com|F|2"] [data ".villamarehiltonhead.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.villamarehiltonhead.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.villamarehiltonhead.com"] [unique_id "arFktffV9-jsgGIdWvjvgAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 15:27:05
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.221.140.59 (59.140.221.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.140.59 (59.140.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 11:26:58.775748 2026] [security2:error] [pid 17366:tid 17366] [client 35.221.140.59:35314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.waggonerfinancial.com"] [uri "/static/../../../a/../../../../.env"] [unique_id "arFMwieUlDKw8sA5bUGoGAAAADQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-21 15:26:17
(1 month ago)
20 attempts against mh-misbehave-ban on melon
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-09-21 15:26:04
(1 month ago)
35.221.140.59 - - [21/Sep/2026:15:25:01 +0000] "POST / HTTP/2.0" 403 189 "-" "DuckAssistBot/1.1 (htt ...
show more
35.221.140.59 - - [21/Sep/2026:15:25:01 +0000] "POST / HTTP/2.0" 403 189 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.221.140.59 - - [21/Sep/2026:15:25:01 +0000] "GET /.env?raw HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
35.221.140.59 - - [21/Sep/2026:15:25:01 +0000] "GET /.env.local?raw HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
35.221.140.59 - - [21/Sep/2026:15:25:01 +0000] "GET /.env?import&url&inline HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
35.221.140.59 - - [21/Sep/2026:15:25:01 +0000] "GET /.env?import&raw HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 14:56:15
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 10:56:10.875376 2026] [security2:error] [pid 24158:tid 24158] [client 35.221.140.59:60608] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||virginialakes395.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "virginialakes395.com"] [uri "/z9x8c7v6b5-debug-trigger-virginialakes395.com"] [unique_id "arFFipESRsmymB5Ui1SPNgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-09-21 14:44:10
(1 month ago)
{"level":"info","ts":1790001836.7171345,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1790001836.7171345,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.221.140.59","remote_port":"59478","client_ip":"35.221.140.59","proto":"HTTP/2.0","method":"GET","host":"status.mygoodporn.com","uri":"/id_ecdsa","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"],"Accept-Encoding":["gzip"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.mygoodporn.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.00016283,"size":0,"status":429,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"],"Server":["Caddy"]}}
{"level":"info","ts":1790001836.7587526,"logger":"http.log.access.log1"
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 14:37:41
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 10:37:38.169862 2026] [security2:error] [pid 7575:tid 7575] [client 35.221.140.59:53430] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.vmmailing.com|F|2"] [data ".vmmailing.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.vmmailing.com"] [uri "/z9x8c7v6b5-debug-trigger-www.vmmailing.com"] [unique_id "arFBMpqTfQaRibGHNtnukQAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 14:06:29
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.140.59 (59.140.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 10:06:24.065039 2026] [security2:error] [pid 12407:tid 12407] [client 35.221.140.59:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vidacellenlaweb.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vidacellenlaweb.com"] [uri "/z9x8c7v6b5-debug-trigger-vidacellenlaweb.com"] [unique_id "arE54Cj_J9iXSqyPBICCpQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-09-21 14:02:46
(1 month ago)
35.221.140.59 - - [21/Sep/2026:14:01:46 +0000] "GET /.profile HTTP/2.0" 403 197 "-" "Mozilla/5.0 (Ma ...
show more
35.221.140.59 - - [21/Sep/2026:14:01:46 +0000] "GET /.profile HTTP/2.0" 403 197 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
35.221.140.59 - - [21/Sep/2026:14:01:46 +0000] "GET /.bash_profile HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)"
35.221.140.59 - - [21/Sep/2026:14:01:46 +0000] "GET /.zshrc HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
35.221.140.59 - - [21/Sep/2026:14:01:46 +0000] "GET /@fs/../.env?raw?? HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
35.221.140.59 - - [21/Sep/2026:14:01:46 +0000] "GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? HTTP/2.0" 403 189 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perpl
...
show less
Web App Attack
🇸🇪
vaia.cloud
2026-09-21 14:00:04
(1 month ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇸🇬
Cloudkul Cloudkul
2026-09-21 13:55:49
(1 month ago)
Attempted Not Found (404 status code) requests on our application, more than 30% of their total requ ...
show more
Attempted Not Found (404 status code) requests on our application, more than 30% of their total requests.
show less
Brute-Force
Web App Attack
2026-09-21 13:29:05
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇮🇹
VHosting
2026-09-21 13:25:08
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-09-21 13:20:08
(1 month ago)
| Common web attack.
Web App Attack
Hacking
SQL Injection
