🇩🇪
klaus_ph
2026-11-13 06:03:26
UTC ·
(1 hour ago)
35.225.56.28 - - [13/Nov/2026:07:03:25 +0100] "GET / HTTP/1.1" 200 5889 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
Bad Web Bot
🇫🇷
masterguru
2026-11-13 05:01:11
UTC ·
(2 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇬🇧
consul.to
2026-11-13 04:43:05
UTC ·
(2 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
debestelapp
2026-11-13 03:50:06
UTC ·
(3 hours ago)
Web App Attack
🇳🇱
Alt255
2026-11-13 03:27:14
UTC ·
(4 hours ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.225.56.28 - - [13/Nov/2026:04:26:52 +0100] "GET /.git/config HTTP/1.1" 404 155818 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHT ...
show more
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.225.56.28 - - [13/Nov/2026:04:26:52 +0100] "GET /.git/config HTTP/1.1" 404 155818 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 02:08:36
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.225.56.28 (28.56.225.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:08:32.544782 2026] [security2:error] [pid 168838:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.225.56.28 (28.56.225.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:08:32.544782 2026] [security2:error] [pid 168838:tid 168838] [client 35.225.56.28:56518] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fishaways.jbaydeliveries.com"] [uri "/.git/config"] [unique_id "avZxIL7GOIYFtQfGSo3m7gAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
neckaralb-admin.de
2026-11-13 01:29:46
UTC ·
(6 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
Blamdom
2026-11-13 01:24:57
UTC ·
(6 hours ago)
Secret/config-file recon: requested /.git/config. 278 HTTP request(s), 2026-11-13 01:24:57 to 01:25:37 UTC (40s).
Requests (method path -> status xcount):
GET [site page] -> 301 x59
POST / -> 200 x4
GET / -> 301 x2
GET /.[redacted] -> 301 x2
...
show more
Secret/config-file recon: requested /.git/config. 278 HTTP request(s), 2026-11-13 01:24:57 to 01:25:37 UTC (40s).
Requests (method path -> status xcount):
GET [site page] -> 301 x59
POST / -> 200 x4
GET / -> 301 x2
GET /.[redacted] -> 301 x2
GET /.git/config -> 301
GET /.env -> 301
GET /.env.local -> 301
GET /.env.production -> 301
...+207 more distinct requests
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 (+1 other UAs)
show less
Hacking
Bad Web Bot
Web App Attack
🇨🇦
Etienne Pilon
2026-11-13 00:59:10
UTC ·
(6 hours ago)
Observed 2026-11-13T00:59:10+00:00 to 2026-11-13T00:59:10+00:00 (UTC). HTTP: 3 requests to sensitive web paths. Active permanent IP ban verified by Observatory. Observed activity only; this is not proof of compromise.
Web App Attack
🇫🇷
dynamix
2026-11-13 00:58:39
UTC ·
(6 hours ago)
Multiple WAF Violations
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-12 23:00:58
UTC ·
(8 hours ago)
Auto-ban: >3000 req/min op 2026-11-12
Web App Attack
SSH
Hacking
2026-11-12 21:10:48
UTC ·
(10 hours ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 20:27:38
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.225.56.28 (28.56.225.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:27:29.238064 2026] [security2:error] [pid 11746:tid 11 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.225.56.28 (28.56.225.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:27:29.238064 2026] [security2:error] [pid 11746:tid 11746] [client 35.225.56.28:57480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.firstclasstreatment.tijuanabible.org"] [uri "/.git/config"] [unique_id "avYhMQHkisTpz3_Zw8OJegAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-11-12 20:05:15
UTC ·
(11 hours ago)
Scanning/Probing (12)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 19:12:14
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.225.56.28 (28.56.225.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:12:10.608739 2026] [security2:error] [pid 9388:tid 938 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.225.56.28 (28.56.225.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:12:10.608739 2026] [security2:error] [pid 9388:tid 9388] [client 35.225.56.28:48202] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.firstampersand.kathiehazlett.com"] [uri "/.git/config"] [unique_id "avYPirTe668Ce3jGO0SY0wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
