🇳🇱
Alt255
2026-11-06 20:08:20
UTC ·
(1 hour ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.221.194.121 - - \[06/Nov/2026:21:08:02 +0100\] "GET /.env.local HTTP/1.1" 403 207 "-" "Mozilla/5.0 \(compatible\; Bravebot/1.0\; +https://brave.com/se ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.221.194.121 - - \[06/Nov/2026:21:08:02 +0100\] "GET /.env.local HTTP/1.1" 403 207 "-" "Mozilla/5.0 \(compatible\; Bravebot/1.0\; +https://brave.com/search/\)"
...
show less
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-11-06 19:57:23
UTC ·
(1 hour ago)
Triggered Cloudflare WAF (firewallCustom) from TW.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /.env.mail
UA: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)
This report was generated by:
https://github.com/sefinek/ ...
show more
Triggered Cloudflare WAF (firewallCustom) from TW.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /.env.mail
UA: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-11-06 19:54:22
UTC ·
(1 hour ago)
(mod_security) mod_security triggered on hostname [redacted] 35.221.194.121 (TW/Taiwan/121.194.221.35.bc.googleusercontent.com): (CF_ENABLE)
SQL Injection
🇧🇾
lns.bz
2026-11-06 18:53:06
UTC ·
(2 hours ago)
.env scanning [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 18:15:18
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.221.194.121 (121.194.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:15:14.632246 2026] [security2:error] [pid 12136:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.194.121 (121.194.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:15:14.632246 2026] [security2:error] [pid 12136:tid 12136] [client 35.221.194.121:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.local639.com"] [uri "/.env.production.bak"] [unique_id "au4ZMrE9YCKOt8VFZXSvIAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
bazter.pro
2026-11-06 18:12:51
UTC ·
(3 hours ago)
Fail2Ban: plesk-bot-aggressive - 15 failures
Port Scan
Bad Web Bot
Web App Attack
🇩🇪
SwinT
2026-11-06 18:00:06
UTC ·
(3 hours ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇨🇦
Mediashaker
2026-11-06 17:56:41
UTC ·
(3 hours ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.221.194.121 (TW/Taiwan/121.194.221.35.bc.googleusercontent.com)
Bad Web Bot
🇲🇾
Rizzy
2026-11-06 17:54:13
UTC ·
(3 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-11-06 17:39:26
UTC ·
(3 hours ago)
Blocked by CSF 13 firewall - Rule: config-dotfile
US/United States/121.194.221.35.bc.googleusercontent.com
Web App Attack
🇩🇪
grassau.com
2026-11-06 17:37:32
UTC ·
(3 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 35.221.194.121 (TW/Taiwan/Taipei City/Taipei/121.194.221.35.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-11-06 17:06:37
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.221.194.121 (121.194.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 12:06:34.206849 2026] [security2:error] [pid 17647:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.194.121 (121.194.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 12:06:34.206849 2026] [security2:error] [pid 17647:tid 17647] [client 35.221.194.121:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ndanetworks.com"] [uri "/.env.production.bak"] [unique_id "au4JGqxUU6HZxZu8gHKv7gAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-11-06 16:48:33
UTC ·
(4 hours ago)
"GET /.amplifyrc HTTP/2.0" 301 162 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +/)"
Brute-Force
🇩🇪
BlueWire Hosting
2026-11-06 16:26:51
UTC ·
(4 hours ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇩🇪
filstal.org
2026-11-06 16:05:39
UTC ·
(5 hours ago)
ModSecurity/OWASP CRS: Protocol-Violation – HTTP header is restricted by policy (/x-middleware-subrequest/) (920450) | GET / + /sitemap.xml | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari ...
show more
ModSecurity/OWASP CRS: Protocol-Violation – HTTP header is restricted by policy (/x-middleware-subrequest/) (920450) | GET / + /sitemap.xml | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153…
show less
Web App Attack
