🇺🇸
TPI-Abuse
2026-10-13 01:15:56
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 21:15:50.485329 2026] [security2:error] [pid 22148:tid 22148] [client 35.229.153.143:37742] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kdgsf.xyz"] [uri "/.htpasswd"] [unique_id "as2GRlCwrjcSK1hdZ-NYngAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
VirtualAllocEx
2026-10-13 01:04:17
(15 hours ago)
Cloudflare automated security report.
Events: 11.
Sources: firewallCustom.
Request paths: /users/log ...
show more
Cloudflare automated security report.
Events: 11.
Sources: firewallCustom.
Request paths: /users/login, /pipeline/.env, /@fs/var/task/.env, /private/.env, /@fs/proc/self/cmdline.
Countries: TW.
ASNs: 396982.
User agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36, Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] ), Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/), DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot).
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 00:54:49
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 20:54:42.079333 2026] [security2:error] [pid 27585:tid 27585] [client 35.229.153.143:55018] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fanarch.xyz"] [uri "/static../.env"] [unique_id "as2BUuhEuy7d22cB363tSgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
VirtualAllocEx
2026-10-13 00:51:52
(15 hours ago)
Cloudflare automated security report.
Events: 40.
Sources: firewallCustom, firewallManaged.
Request ...
show more
Cloudflare automated security report.
Events: 40.
Sources: firewallCustom, firewallManaged.
Request paths: /panel/.env, /data/.env, /docker-compose/.env, /.env_1, /workspace/.env.
Countries: TW.
ASNs: 396982.
User agents: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] ), Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/), Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/), Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36, Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html).
show less
Web App Attack
🇺🇸
VirtualAllocEx
2026-10-12 19:45:56
(20 hours ago)
Cloudflare automated security report.
Events: 53.
Sources: firewallCustom, firewallManaged.
Request ...
show more
Cloudflare automated security report.
Events: 53.
Sources: firewallCustom, firewallManaged.
Request paths: /cgi-bin/php, /config/.env.local, /chatbot/.env, /docker-compose/.env, /.aws/credentials.
Countries: TW.
ASNs: 396982.
User agents: Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler), Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot, Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot), Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/).
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 19:42:20
(20 hours ago)
(mod_security) mod_security (id:210580) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210580) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 15:42:11.254024 2026] [security2:error] [pid 10873:tid 10873] [client 35.229.153.143:51708] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||cier.xyz|F|2"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "cier.xyz"] [uri "/api/console/api_server"] [unique_id "as04E5DCPzzcdFn3YSz9-AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-12 15:46:44
(1 day ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
TPI-Abuse
2026-10-12 15:34:11
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.153.143 (143.153.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 11:34:05.282985 2026] [security2:error] [pid 24134:tid 24134] [client 35.229.153.143:50524] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cthog.xyz"] [uri "/.env.supabase"] [unique_id "asz97V6WnkAkSMwdnonCPQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Octopuce
2026-10-12 11:59:45
(1 day ago)
Aggressive web search of vulnerable pages: /static../.env /media../.env /public../.env /img../.env / ...
show more
Aggressive web search of vulnerable pages: /static../.env /media../.env /public../.env /img../.env /static//home/user/.env ...
show less
Web App Attack
🇪🇸
antivoid.xyz
2026-10-12 11:49:47
(1 day ago)
Brute-Force
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-12 11:32:58
(1 day ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇫🇮
000rosiu
2026-10-12 11:23:23
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from TW.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallManaged) from TW.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoint: /dashboard | UA: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇮
TrafficAnalyser
2026-10-12 11:14:12
(1 day ago)
Port scanning
Port Scan
2026-10-12 05:24:56
(1 day ago)
Aggressive web scan
Web App Attack
2026-10-12 05:00:18
(1 day ago)
| [Dangerous/Taiwan] Aggressive IP 35.229.153.143 (~30 hits). Type: DoS Defender- Web server 400 err ...
show more
| [Dangerous/Taiwan] Aggressive IP 35.229.153.143 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Web App Attack
Hacking
SQL Injection
