🇫🇷
COMAITE
2026-06-08 16:23:23
(1 week ago)
Suspicious URL access.
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 10:56:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 06:56:09.296514 2026] [security2:error] [pid 9572:tid 9572] [client 35.227.9.132:52016] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jodstar.com"] [uri "/config/config.yml"] [unique_id "aiafyWNG-_fprRU-xo17sgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Origon
2026-06-08 10:17:26
(1 week ago)
http-probing - IP: 35.227.9.132 - time="2026-06-08T12:17:25+02:00" level=info msg="(555f66b4f6a7455 ...
show more
http-probing - IP: 35.227.9.132 - time="2026-06-08T12:17:25+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 35.227.9.132 (US/396982) : 4h ban on Ip 35.227.9.132" module=db
show less
Web App Attack
🇳🇱
e.fierstra
2026-06-08 10:15:28
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-06-08 10:09:53
(1 week ago)
Abuse Detected (14)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 09:54:09
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:54:03.037637 2026] [security2:error] [pid 25306:tid 25306] [client 35.227.9.132:33580] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||web99.dnchosting.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "web99.dnchosting.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiaRO72t5YEcEf1NyAiSDAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 06:19:26
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 02:19:23.036868 2026] [security2:error] [pid 29015:tid 29015] [client 35.227.9.132:53196] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tekrav.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tekrav.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiZe6x-3zMPtDGv_ygF86wAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 05:58:04
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 01:58:00.572338 2026] [security2:error] [pid 23773:tid 23773] [client 35.227.9.132:33070] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||prcomputersolutions.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "prcomputersolutions.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiZZ6MrHs3IHRfT3Hq1bsgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-06-08 05:54:47
(1 week ago)
35.227.9.132 - - [08/Jun/2026:15:54:46 +1000] "GET /env HTTP/1.1" 403 984 "-" "Mozilla/5.0 (Linux; U ...
show more
35.227.9.132 - - [08/Jun/2026:15:54:46 +1000] "GET /env HTTP/1.1" 403 984 "-" "Mozilla/5.0 (Linux; U; Android 2.2; en-us; Nexus One Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
35.227.9.132 - - [08/Jun/2026:15:54:46 +1000] "GET /api/actuator/logfile HTTP/1.1" 403 984 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36"
35.227.9.132 - - [08/Jun/2026:15:54:46 +1000] "GET /api/heapdump HTTP/1.1" 403 984 "-" "Mozilla/5.0 (en-us) AppleWebKit/525.13 (KHTML, like Gecko; Google Web Preview) Version/3.1 Safari/525.13"
35.227.9.132 - - [08/Jun/2026:15:54:46 +1000] "GET /api/env HTTP/1.1" 403 984 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3676.400 QQBrowser/10.4.3469.400"
35.227.9.132 - - [08/Jun/2026:15:54:46 +1000] "GET /app/actuator/heapdump HTTP/1.1" 403 984 "-" "Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0
...
show less
Bad Web Bot
🇩🇪
Ba-Yu
2026-06-08 05:22:45
(1 week ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇨🇦
Mediashaker
2026-06-08 04:35:47
(1 week ago)
(CT) IP 35.227.9.132 (US/United States/132.9.227.35.bc.googleusercontent.com) found to have 562 conn ...
show more
(CT) IP 35.227.9.132 (US/United States/132.9.227.35.bc.googleusercontent.com) found to have 562 connections
show less
DDoS Attack
🇺🇸
TPI-Abuse
2026-06-08 04:28:07
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.227.9.132 (132.9.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 00:28:03.278986 2026] [security2:error] [pid 14099:tid 14099] [client 35.227.9.132:45158] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||centreguephel.org|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "centreguephel.org"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiZE0yCRdtnOwN8jsxeFUgAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-06-08 04:04:04
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 35.227.9.132 (US/United States/132.9.227.35.bc. ...
show more
(mod_security) mod_security (id:949110) triggered by 35.227.9.132 (US/United States/132.9.227.35.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇫🇷
dynamix
2026-06-08 02:53:11
(1 week ago)
Multiple WAF Violations
Web App Attack
2026-06-08 01:35:02
(1 week ago)
Multiple web server 400 error codes from same source ip
Web App Attack