🇬🇧
consul.to
2026-09-30 18:33:05
(4 hours ago)
Web attack/malicious scanning detected
Web App Attack
2026-09-30 17:01:12
(5 hours ago)
Fail2Ban apache-noscript
Bad Web Bot
🇳🇱
Alt255
2026-09-30 15:14:19
(7 hours ago)
[cb-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.229.185.183 - - [30/Sep/2026:17:14:00 +0200] "GET /__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc HTTP/1.0" 404 92519 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 14:04:11
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 10:04:06.678727 2026] [security2:error] [pid 8610:tid 8610] [client 35.229.185.183:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sahinozalit.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sahinozalit.com"] [uri "/z9x8c7v6b5-debug-trigger-sahinozalit.com"] [unique_id "ar0W1gowldPqoyaVfcGnHgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 13:40:09
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 09:39:57.331906 2026] [security2:error] [pid 19330:tid 19330] [client 35.229.185.183:55756] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.mapleleaf-marketing.com"] [uri "/static../.env"] [unique_id "ar0RLRWWAXG4n5sZTnsDcQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 13:21:57
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 09:21:49.623209 2026] [security2:error] [pid 25212:tid 25212] [client 35.229.185.183:35174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.alanmariotti.com"] [uri "/.env.js"] [unique_id "ar0M7UfFtmPD_AQQJuGbEwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-30 13:00:05
(9 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 12:08:39
(10 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 08:08:34.010357 2026] [security2:error] [pid 21846:tid 21846] [client 35.229.185.183:58006] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.evannine.com|F|2"] [data ".evannine.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.evannine.com"] [uri "/z9x8c7v6b5-debug-trigger-www.evannine.com"] [unique_id "arz7wv9_bJ3LzzMgsmZeWgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 11:42:53
(10 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 07:42:46.949917 2026] [security2:error] [pid 31737:tid 31737] [client 35.229.185.183:58112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sailingcharterburma.phuket-boatcharter.com|F|2"] [data ".sailingcharterburma.phuket-boatcharter.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sailingcharterburma.phuket-boatcharter.com"] [uri "/z9x8c7v6b5-debug-trigger-www.sailingcharterburma.phuket-boatcharter.com"] [unique_id "arz1ti6BDCWZI3LCu0lIvQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-30 11:23:51
(11 hours ago)
Multiple WAF Violations
Web App Attack
2026-09-30 11:02:47
(11 hours ago)
2026/09/30 11:02:43 [error] 2479718#2479718: *467003 [client 35.229.185.183] ModSecurity: Access den ...
show more
2026/09/30 11:02:43 [error] 2479718#2479718: *467003 [client 35.229.185.183] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `40' ) [file "/usr/local/owasp-modsecurity-crs-4.11.0/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.29.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "register.royalealmond.com"] [uri "/"] [unique_id "17907661631.984563"] [ref ""], client: 35.229.185.183, server: srv.ingeltechgh.com, request: "POST / HTTP/2.0", host: "register.royalealmond.com"
2026/09/30 11:02:45 [error] 2479718#2479718: *467003 [client 35.229.185.183] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-09-30 10:54:54
(11 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:54:51.509501 2026] [security2:error] [pid 6240:tid 6253] [client 35.229.185.183:48316] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.runawaydixie.com|F|2"] [data ".runawaydixie.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.runawaydixie.com"] [uri "/z9x8c7v6b5-debug-trigger-www.runawaydixie.com"] [unique_id "arzqez83WPi6zmTfTyp9_QAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 10:32:16
(12 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.185.183 (183.185.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:32:11.875500 2026] [security2:error] [pid 14614:tid 14614] [client 35.229.185.183:60286] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||rphenry.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rphenry.com"] [uri "/z9x8c7v6b5-debug-trigger-rphenry.com"] [unique_id "arzlK-6GwIHG_TnjIBm8jwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
OceanTreasure
2026-09-30 07:21:57
(15 hours ago)
tcp/8443; Unsolicited SYN to a port that has never been offered on this address (closed, no service ...
show more
tcp/8443; Unsolicited SYN to a port that has never been offered on this address (closed, no service ever) @ 2026-09-30T07:10:13Z
show less
Port Scan
