2026-09-01 04:50:10
(46 minutes ago)
| Suspicious URL access.
Web App Attack
Hacking
SQL Injection
🇳🇱
WeCloudit-Anti-Abuse
2026-09-01 04:40:47
(56 minutes ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇫🇷
a.mohamed.go
2026-09-01 04:39:41
(57 minutes ago)
35.227.86.201 - - [01/Sep/2026:04:39:40 +0000] "GET /actuator/env HTTP/1.1" 200 2606 "-" "crusader-w ...
show more
35.227.86.201 - - [01/Sep/2026:04:39:40 +0000] "GET /actuator/env HTTP/1.1" 200 2606 "-" "crusader-worker/1.0"
...
show less
Hacking
Web App Attack
🇫🇷
dynamix
2026-09-01 04:38:50
(58 minutes ago)
Multiple WAF Violations
Web App Attack
2026-09-01 04:27:06
(1 hour ago)
Bot / scanning and/or hacking attempts: GET /.env.production HTTP/1.1, GET /.env.prod HTTP/1.1, GET ...
show more
Bot / scanning and/or hacking attempts: GET /.env.production HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.old HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
wpadm4
2026-09-01 04:17:18
(1 hour ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇧🇪
voormedia
2026-09-01 04:17:13
(1 hour ago)
Accessed trap at '/.env'
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 04:03:32
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 35.227.86.201 (201.86.227.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.227.86.201 (201.86.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:03:28.694481 2026] [security2:error] [pid 20538:tid 20538] [client 35.227.86.201:42066] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "limpiezadevidriosyoficinas.com"] [uri "/.env.old"] [unique_id "apZOkEl_U7BOojpZTnCbBAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-01 03:30:46
(2 hours ago)
[01/Sep/2026:06:30:46 +0300] -- 35.227.86.201 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env ...
show more
[01/Sep/2026:06:30:46 +0300] -- 35.227.86.201 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env.dev HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-01 03:05:22
(2 hours ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
ISPLtd
2026-09-01 02:30:48
(3 hours ago)
Aug 31 23:30:48 35.227.86.201 TCP SPT=54392 DPT=80 SYN
Aug 31 23:30:48 35.227.86.201 TCP SPT=54400 D ...
show more
Aug 31 23:30:48 35.227.86.201 TCP SPT=54392 DPT=80 SYN
Aug 31 23:30:48 35.227.86.201 TCP SPT=54400 DPT=80 SYN
Aug 31 23:30:48 35.227.86.201 TCP SPT=54418 DPT=80 SYN
Aug
...
show less
DDoS Attack
🇬🇧
consul.to
2026-09-01 02:26:41
(3 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 01:41:59
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.227.86.201 (201.86.227.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.227.86.201 (201.86.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 21:41:51.967674 2026] [security2:error] [pid 16048:tid 16048] [client 35.227.86.201:58512] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||herston.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "herston.net"] [uri "/storage/logs/laravel.log"] [unique_id "apYtX9Jc0sGfqsxaU7T-5AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 01:20:31
(4 hours ago)
(mod_security) mod_security (id:949110) triggered by 35.227.86.201 (201.86.227.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:949110) triggered by 35.227.86.201 (201.86.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 21:20:24.058289 2026] [security2:error] [pid 32543:tid 32543] [client 35.227.86.201:39322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "donate.freedrm.org"] [uri "/wp-config.php~"] [unique_id "apYoWHi7-mbL4Ok4bJ-64QAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 00:18:02
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.227.86.201 (201.86.227.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.227.86.201 (201.86.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 20:17:53.357563 2026] [security2:error] [pid 4525:tid 4525] [client 35.227.86.201:36214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.rbmediaworks.com"] [uri "/.env.local"] [unique_id "apYZsR2JUoLICieJHK7aYQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack