🇩🇪
klaus_ph
2026-09-27 14:06:49
(2 weeks ago)
2026-09-26 06:49:39,604 fail2ban.actions [594716]: NOTICE [ipblocklist] Ban 35.230.38.228
.. ...
show more
2026-09-26 06:49:39,604 fail2ban.actions [594716]: NOTICE [ipblocklist] Ban 35.230.38.228
...
show less
Bad Web Bot
🇮🇳
evicky2002
2026-09-23 06:00:01
(2 weeks ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇬🇧
openstrike.co.uk
2026-09-23 05:14:44
(2 weeks ago)
6 attacks on password/key grabbing URLs:
GET /id_ecdsa HTTP/1.1
Hacking
🇦🇺
2000cn.com.au
2026-09-23 03:10:34
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇬🇧
noise.agency
2026-09-23 03:07:22
(2 weeks ago)
35.230.38.228 (US/United States/228.38.230.35.bc.googleusercontent.com), more than 30 Apache 404 hit ...
show more
35.230.38.228 (US/United States/228.38.230.35.bc.googleusercontent.com), more than 30 Apache 404 hits
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-23 03:05:30
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 23:05:24.917937 2026] [security2:error] [pid 20153:tid 20153] [client 35.230.38.228:50074] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ardeeapps.com|F|2"] [data ".ardeeapps.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ardeeapps.com"] [uri "/z9x8c7v6b5-debug-trigger-www.ardeeapps.com"] [unique_id "arNB9NNbX0VHQvADRau_8AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-23 01:42:14
(2 weeks ago)
This address requests our sites over plain http, is answered with a redirect to https, and never fol ...
show more
This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; blocked. Please check what runs on this address. | method: GET | path: / | 2026-09-23 01:42 UTC
show less
Bad Web Bot
🇳🇱
Site.eu
2026-09-23 01:38:35
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-09-23 00:58:08
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 20:58:04.771412 2026] [security2:error] [pid 15265:tid 15265] [client 35.230.38.228:33384] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aprilparks.com|F|2"] [data ".aprilparks.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aprilparks.com"] [uri "/z9x8c7v6b5-debug-trigger-www.aprilparks.com"] [unique_id "arMkHKNzgGi1LpEErRq-iAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 00:08:31
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 20:08:26.991758 2026] [security2:error] [pid 30192:tid 30192] [client 35.230.38.228:36522] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||alessiaalessandra.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alessiaalessandra.com"] [uri "/z9x8c7v6b5-debug-trigger-alessiaalessandra.com"] [unique_id "arMYegyk8tm8pIVp3cRSyQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-22 23:38:12
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 22:56:23
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.230.38.228 (228.38.230.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.230.38.228 (228.38.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 18:56:16.408095 2026] [security2:error] [pid 8196:tid 8308] [client 35.230.38.228:56402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aqutar.com"] [uri "/.env"] [unique_id "arMHkBw1WdNEvztOE00iJwAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
pm33
2026-09-22 21:53:59
(2 weeks ago)
Excessive crawling HTTP 404
Web App Attack
2026-09-22 21:38:18
(2 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 21:35:34
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.38.228 (228.38.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 17:35:27.063739 2026] [security2:error] [pid 13227:tid 13227] [client 35.230.38.228:50540] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||arctic-sea.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "arctic-sea.com"] [uri "/z9x8c7v6b5-debug-trigger-arctic-sea.com"] [unique_id "arL0n9h4RrPIQKB73t9srwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
