🇩🇪
klaus_ph
2026-09-23 20:28:18
(8 hours ago)
2026-09-23 03:52:04,708 fail2ban.actions [535885]: NOTICE [ipblocklist] Ban 35.230.7.28
...
Bad Web Bot
🇮🇳
evicky2002
2026-09-22 06:00:01
(1 day ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇫🇷
IRISIO
2026-09-21 12:38:01
(2 days ago)
scans/SQL injection/spam posts : 892 queries
Web App Attack
SQL Injection
🇺🇸
TPI-Abuse
2026-09-21 06:32:16
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 02:32:12.007640 2026] [security2:error] [pid 21362:tid 21362] [client 35.230.7.28:36624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.dltlogisticsinc.com"] [uri "/css../.env"] [unique_id "arDPbDv3MeaopZM-eDirgQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-21 06:29:24
(2 days ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇩🇪
konseptit
2026-09-21 06:03:00
(2 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.230.7.28 (US/United States/28.7.230. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.230.7.28 (US/United States/28.7.230.35.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-09-21 05:48:12
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:48:04.139821 2026] [security2:error] [pid 27420:tid 27420] [client 35.230.7.28:39710] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.holgerfeld.com"] [uri "/@fs/../.env"] [unique_id "arDFFJgG5rSR-GBryITCYwAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 05:12:05
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:12:00.089545 2026] [security2:error] [pid 17222:tid 17222] [client 35.230.7.28:54790] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.jamroomrecording.com"] [uri "/@fs/app/.env"] [unique_id "arC8oLcClXGrdIoYuv07AAAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bazter.pro
2026-09-21 04:41:48
(2 days ago)
Fail2Ban: apache-ratelimit - 20 failures
Port Scan
Bad Web Bot
Web App Attack
🇳🇱
GabrielJST
2026-09-21 04:24:00
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.230.7.28 (US/United States/28.7.230. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.230.7.28 (US/United States/28.7.230.35.bc.googleusercontent.com): (CF_ENABLE)
show less
SQL Injection
🇩🇪
itsolon
2026-09-21 04:05:21
(3 days ago)
[21/Sep/2026:06:05:20 +0200] 178996352029.238937 35.230.7.28 36330 217.154.7.177 443
[21/Sep/2026:06 ...
show more
[21/Sep/2026:06:05:20 +0200] 178996352029.238937 35.230.7.28 36330 217.154.7.177 443
[21/Sep/2026:06:05:20 +0200] 178996352030.226309 35.230.7.28 36330 217.154.7.177 443
[21/Sep/2026:06:05:20 +0200] 17899635203.225048 35.230.7.28 36330 217.154.7.177 443
[21/Sep/2026:06:05:21 +0200] 178996352186.618491 35.230.7.28 36314 217.154.7.177 443
[21/Sep/2026:06:05:21 +0200] 17899635210.405646 35.230.7.28 36314 217.154.7.177 443
...
show less
Port Scan
Hacking
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-09-21 03:42:21
(3 days ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-09-21 03:38:55
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:38:51.525926 2026] [security2:error] [pid 732:tid 732] [client 35.230.7.28:54786] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gilbertortegajewelry.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gilbertortegajewelry.com"] [uri "/z9x8c7v6b5-debug-trigger-gilbertortegajewelry.com"] [unique_id "arCmy9Q5zKam6_wCzBdIAwAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
proactive-noc
2026-09-21 03:13:52
(3 days ago)
Web application abuse detected 26 times recently; honeypot-j.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:10:51
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 35.230.7.28 (28.7.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:10:43.658021 2026] [security2:error] [pid 9172:tid 9198] [client 35.230.7.28:53410] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "honeyled.com"] [uri "/.env.production"] [unique_id "arCgM5EG3_NdF1Eavl8xuAAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
