🇩🇪
Gwyneth Llewelyn
2026-11-06 20:26:12
UTC ·
(5 days ago)
2026/11/06 20:26:10 [error] 3084#3084: *1329419 access forbidden by rule, client: 35.221.150.89, server: api.betatechnologies.info, request: "GET /packages/api/.env HTTP/2.0", host: "api.betatechnologies.info"
2026/11/06 20:26:10 [error] 3084#3084: * ...
show more
2026/11/06 20:26:10 [error] 3084#3084: *1329419 access forbidden by rule, client: 35.221.150.89, server: api.betatechnologies.info, request: "GET /packages/api/.env HTTP/2.0", host: "api.betatechnologies.info"
2026/11/06 20:26:10 [error] 3084#3084: *1329419 access forbidden by rule, client: 35.221.150.89, server: api.betatechnologies.info, request: "GET /apps/marketing/.env HTTP/2.0", host: "api.betatechnologies.info"
2026/11/06 20:26:10 [error] 3084#3084: *1329419 access forbidden by rule, client: 35.221.150.89, server: api.betatechnologies.info, request: "GET /apps/admin/.env HTTP/2.0", host: "api.betatechnologies.info"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 20:17:33
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 35.221.150.89 (89.150.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:17:27.175847 2026] [security2:error] [pid 2234778:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.150.89 (89.150.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:17:27.175847 2026] [security2:error] [pid 2234778:tid 2234846] [client 35.221.150.89:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.callaplusfirst.com|F|2"] [data ".callaplusfirst.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.callaplusfirst.com"] [uri "/z9x8c7v6b5-debug-trigger-www.callaplusfirst.com"] [unique_id "au4112g7hdF6EQgrEj8udAAAAYI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-11-06 19:35:09
UTC ·
(5 days ago)
Web App Attack
🇳🇱
Brict IT
2026-11-06 19:24:34
UTC ·
(5 days ago)
DDoS Attack
FTP Brute-Force
2026-11-06 19:04:01
UTC ·
(5 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
Hazzard
2026-11-06 18:12:19
UTC ·
(5 days ago)
(PERMBLOCK) 35.221.150.89 (TW/Taiwan/Taipei City/Taipei/89.150.221.35.bc.googleusercontent.com/[redacted]) has had more than 4 temp blocks
Hacking
🇳🇱
Alt255
2026-11-06 18:11:50
UTC ·
(5 days ago)
[cb-08al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 35.221.150.89 - - [06/Nov/2026:19:11:47 +0100] "GET /q0o5xhfazdzfvaqq2vxw HTTP/2.0" 404 1422 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS ...
show more
[cb-08al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 35.221.150.89 - - [06/Nov/2026:19:11:47 +0100] "GET /q0o5xhfazdzfvaqq2vxw HTTP/2.0" 404 1422 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
35.221.150.89 - - [06/Nov/2026:19:11:47 +0100] "GET /asset-manifest.json HTTP/2.0" 404 1422 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
35.221.150.89 - - [06/Nov/2026:19:11:47 +0100] "GET /assets/manifest.json HTTP/2.0" 404 1422 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
35.221.150.89 - - [06/Nov/2026:19:11:47 +0100] "GET /webpack-stats.json HTTP/2.0" 404 1422 "-" "Mozilla/5.0 (Win
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-06 17:28:17
UTC ·
(5 days ago)
[ti-26al] Excessive 404 errors (web scanning): 26 suspicious requests detected by fail2ban jail apache-404. Example: 35.221.150.89 - - [06/Nov/2026:18:28:09 +0100] "GET /sitemap.xml HTTP/1.1" 404 2107 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https ...
show more
[ti-26al] Excessive 404 errors (web scanning): 26 suspicious requests detected by fail2ban jail apache-404. Example: 35.221.150.89 - - [06/Nov/2026:18:28:09 +0100] "GET /sitemap.xml HTTP/1.1" 404 2107 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
35.221.150.89 - - [06/Nov/2026:18:28:10 +0100] "GET /checkout HTTP/1.1" 404 2107 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
35.221.150.89 - - [06/Nov/2026:18:28:11 +0100] "GET /fi3rbpf388j2qfhcy3ko HTTP/1.1" 404 2107 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
35.221.150.89 - - [06/Nov/2026:18:28:11 +0100] "GET /dashboard HTTP/1.1" 404 7825 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C
...
show less
Bad Web Bot
Web App Attack
🇫🇷
mail.avx.gr
2026-11-06 17:06:49
UTC ·
(5 days ago)
plesk-rapid-ban env-second-probe host=candiatrade.gr
Hacking
🇺🇸
WPJoe
2026-11-06 16:43:22
UTC ·
(5 days ago)
[Fri Nov 06 16:43:22.250062 2026] [authz_core:error] [pid 949963:tid 133679716234944] [client 35.221.150.89:52088] AH01630: client denied by server configuration: /var/www/html/static..
[Fri Nov 06 16:43:22.316844 2026] [authz_core:error] [pid 949963 ...
show more
[Fri Nov 06 16:43:22.250062 2026] [authz_core:error] [pid 949963:tid 133679716234944] [client 35.221.150.89:52088] AH01630: client denied by server configuration: /var/www/html/static..
[Fri Nov 06 16:43:22.316844 2026] [authz_core:error] [pid 949963:tid 133679154185920] [client 35.221.150.89:52098] AH01630: client denied by server configuration: /var/www/html/media..
...
show less
Web App Attack
Bad Web Bot
🇩🇪
mbch
2026-11-06 16:18:42
UTC ·
(6 days ago)
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-11-06T16:18:42.448000+00:00 to 2026-11-06T16:18:45.117000+00:00: 10 distinct paths in 2.669s, denied HTTP 404. Trusted client-IP processing; forw ...
show more
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-11-06T16:18:42.448000+00:00 to 2026-11-06T16:18:45.117000+00:00: 10 distinct paths in 2.669s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /dist/manifest.json, /build/manifest.json, /.vite/manifest.json, /dist/.vite/manifest.json, /wp-admin/.env, /graphql, /static/.env, /api/.env/public/.env, /api/graphql, /.env.
show less
Web App Attack
🇫🇷
dynamix
2026-11-06 15:10:51
UTC ·
(6 days ago)
Multiple WAF Violations
Web App Attack
🇳🇱
ams_sec_user
2026-11-06 15:05:36
UTC ·
(6 days ago)
Automated requests against a hosted website: 357 requests between 14:00 and 14:59 UTC; 169 probes for exposed secrets/config files (/userfiles, /userfiles/x, /.env.credentials). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-06 15:00:57
UTC ·
(6 days ago)
(modsec_attack) srv104 ModSecurity attack 35.221.150.89 (TW/Taiwan/89.150.221.35.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇿🇦
conure.sh
2026-11-06 14:57:55
UTC ·
(6 days ago)
csagent: score 20.7: 404 noise floor x3, secrets grab x2; 1 domain(s) in 3s
Web App Attack
