2026-10-07 03:59:19
(1 week ago)
Aggressive web scan
Web App Attack
2026-10-07 03:46:57
(1 week ago)
XSS Attempt
Hacking
🇧🇪
cmbplf
2026-10-07 03:33:55
(1 week ago)
152 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
🇮🇪
tarlabs
2026-10-07 00:52:55
(1 week ago)
IP banned by Fail2Ban (traefik-404 jail)
Web App Attack
2026-10-07 00:07:12
(1 week ago)
Automated web scanner. Requested suspicious paths: /build/manifest.json | /z9x8c7v6b5-debug-trigger- ...
show more
Automated web scanner. Requested suspicious paths: /build/manifest.json | /z9x8c7v6b5-debug-trigger-tigzig.com | /.vite/manifest.json | /dist/.vite/manifest.json, /dist/manifest.json | /z9x8c7v6b5-debug-trigger-tigzig.com | /.vite/manifest.json | /dist/.vite/manifest.json. UTC: 2026-10-06 23:38:41.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 23:30:43
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 35.230.94.43 (43.94.230.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:949110) triggered by 35.230.94.43 (43.94.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 19:30:37.015056 2026] [security2:error] [pid 15887:tid 15887] [client 35.230.94.43:51714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "theshitmyaisays.com"] [uri "/z9x8c7v6b5-debug-trigger-theshitmyaisays.com"] [unique_id "asWEnc_mu-0AUgPl_trPGgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 23:09:39
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.230.94.43 (43.94.230.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.94.43 (43.94.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 19:09:35.837866 2026] [security2:error] [pid 2408:tid 2408] [client 35.230.94.43:54014] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tell-me-first.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tell-me-first.com"] [uri "/z9x8c7v6b5-debug-trigger-tell-me-first.com"] [unique_id "asV_r5jwQ7gHCiQdPCCTIQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-06 22:56:34
(1 week ago)
35.230.94.43 - - [06/Oct/2026:22:56:32 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+ ...
show more
35.230.94.43 - - [06/Oct/2026:22:56:32 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 107 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
35.230.94.43 - - [06/Oct/2026:22:56:33 +0000] "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
CDO
2026-10-06 22:31:49
(1 week ago)
URL Injection attempt detected. Automated web attack.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
masterguru
2026-10-06 22:13:05
(1 week ago)
OS File Access Attempt. Matched phrase "proc/self/environ" at ARGS:0. (930120-205)
Hacking
🇺🇸
dot.mg
2026-10-06 22:02:01
(1 week ago)
Scan of vulnerable files
Web App Attack
2026-10-06 19:09:21
(1 week ago)
harvesting of secret and configuration files (.env, .git/config, .aws/credentials, SSH keys); e.g. / ...
show more
harvesting of secret and configuration files (.env, .git/config, .aws/credentials, SSH keys); e.g. /@fs/var/task/.env, /key.pem, /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ. Requests blocked by our WAF (automated report).
show less
Web App Attack
Hacking
🇳🇱
Site.eu
2026-10-06 18:15:59
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-06 17:41:33
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.230.94.43 (43.94.230.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.230.94.43 (43.94.230.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 13:41:26.580694 2026] [security2:error] [pid 5277:tid 5277] [client 35.230.94.43:60728] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||natesupport.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "natesupport.com"] [uri "/z9x8c7v6b5-debug-trigger-natesupport.com"] [unique_id "asUyxgkr4KAU3Pa5oHqx6wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
aks4226
2026-10-06 17:33:54
(1 week ago)
Attacking common web applications.
Web App Attack
