🇩🇪
jasperedv.de
2026-06-10 09:49:35
(2 hours ago)
Apache Login - Brutforcing
Web App Attack
Brute-Force
2026-06-10 07:30:06
(4 hours ago)
35.229.18.108 - - [10/Jun/2026:09:30:05 +0200] "GET /internal/actuator/heapdump HTTP/1.1" 301 169 "- ...
show more
35.229.18.108 - - [10/Jun/2026:09:30:05 +0200] "GET /internal/actuator/heapdump HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"
show less
Web App Attack
🇩🇪
updown.io
2026-06-10 05:49:10
(6 hours ago)
{"level":"info","ts":1781070549.9704149,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781070549.9704149,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.229.18.108","remote_port":"42056","client_ip":"35.229.18.108","proto":"HTTP/1.1","method":"GET","host":"status.lexusforum.be","uri":"/backend/actuator/env","headers":{"Accept-Encoding":["gzip"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3880.5 Mobile Safari/537.36"],"Accept-Charset":["utf-8"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.lexusforum.be","ech":false}},"bytes_read":0,"user_id":"","duration":0.002286565,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1781070549.9761083,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.229.18.108","remote_port":"42092","client_ip":"35.229.18.108","proto":"HTTP/1.1
...
show less
DDoS Attack
Web App Attack
🇬🇧
Oakley
2026-06-10 05:13:10
(6 hours ago)
(confirmed_bot_sig) Confirmed bot
Hacking
🇹🇷
hostopya.com
2026-06-10 05:01:59
(6 hours ago)
Failed login attempt detected by Fail2Ban in plesk-apache jail
Web App Attack
🇧🇪
cmbplf
2026-06-10 04:36:33
(7 hours ago)
178 requests with url.path *credentials.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-10 01:59:35
(9 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.18.108 (108.18.229.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.18.108 (108.18.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 21:59:32.490886 2026] [security2:error] [pid 30236:tid 30236] [client 35.229.18.108:56586] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||scoutmountaindistrict.org|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "scoutmountaindistrict.org"] [uri "/.config/gcloud/credentials.db"] [unique_id "aijFBMF_2PMRYmR06V_4MQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-10 01:44:24
(10 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
Marc
2026-06-09 23:03:08
(12 hours ago)
35.229.18.108 - - [10/Jun/2026:01:03:08 +0200] "GET /.gitlab-ci.yml HTTP/1.1" 404 3230 "-" "Mozilla/ ...
show more
35.229.18.108 - - [10/Jun/2026:01:03:08 +0200] "GET /.gitlab-ci.yml HTTP/1.1" 404 3230 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Lenovo P1a42) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36" 35.229.18.108 - - [10/Jun/2026:01:03:08 +0200] "GET /.github/workflows/main.yml HTTP/1.1" 404 3230 "-" "Mozilla/4.1 (compatible; MSIE 5.0; Symbian OS; Nokia 6600;452) Opera 6.20 [en-US]" 35.229.18.108 - - [10/Jun/2026:01:03:08 +0200] "GET /.github/workflows/deploy.yml HTTP/1.1" 404 3231 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36"
show less
Brute-Force
🇳🇱
homeshowdomain.nl
2026-06-09 22:01:27
(13 hours ago)
Auto-ban: >3000 req/min op 2026-06-09
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-06-09 18:55:45
(16 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.18.108 (108.18.229.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.18.108 (108.18.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 14:55:41.089255 2026] [security2:error] [pid 29467:tid 29487] [client 35.229.18.108:48988] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.certifiedfinancialmanager.aafm.us|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.certifiedfinancialmanager.aafm.us"] [uri "/.config/gcloud/credentials.db"] [unique_id "aihhrYOwx6ll2dYeE7c3FwAAARE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 17:06:00
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.229.18.108 (108.18.229.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.18.108 (108.18.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 13:05:56.003439 2026] [security2:error] [pid 27826:tid 27826] [client 35.229.18.108:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.webuildbeaches.com"] [uri "/config/config.yml"] [unique_id "aihH9HVyiJ5b03_5zMKqfQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-09 16:20:02
(19 hours ago)
[redacted] 35.229.18.108 - - [09/Jun/2026:18:19:57 +0200] "GET /admin/phpinfo.php HTTP/1.1" 404 2955 ...
show more
[redacted] 35.229.18.108 - - [09/Jun/2026:18:19:57 +0200] "GET /admin/phpinfo.php HTTP/1.1" 404 29559 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1664.3 Safari/537.36"
[redacted] 35.229.18.108 - - [09/Jun/2026:18:19:58 +0200] "GET /mysqldump.sql HTTP/1.1" 404 29549 "-" "Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.16"
[redacted] 35.229.18.108 - - [09/Jun/2026:18:19:58 +0200] "GET /db.sql HTTP/1.1" 404 29533 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.158 Safari/537.36 Vivaldi/2.5.1525.43"
[redacted] 35.229.18.108 - - [09/Jun/2026:18:19:58 +0200] "GET /db.sql.gz HTTP/1.1" 404 29541 "-" "Mozilla/4.0 (compatible; MSIE 6.0; j2me) ReqwirelessWeb/3.5"
[redacted] 35.229.18.108 - - [09/Jun/2026:18:19:58 +0200] "GET /db.zip HTTP/1.1" 404 29533 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot
...
show less
Hacking
Web App Attack
2026-06-09 14:48:14
(21 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
2026-06-09 12:17:39
(23 hours ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack