🇺🇸
TPI-Abuse
2026-09-06 03:54:38
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.233.64.162 (162.64.233.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.233.64.162 (162.64.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:54:31.812726 2026] [security2:error] [pid 18042:tid 18060] [client 35.233.64.162:33282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.lcncmo.com"] [uri "/wp-config.php.bak"] [unique_id "apzj9_BEH8oKGMOdva8-_gAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Petros Stefanakis
2026-09-06 03:52:08
(10 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 35.233.64.162 (BE/Belgium/162.64.233.35 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.233.64.162 (BE/Belgium/162.64.233.35.bc.googleusercontent.com)
show less
SQL Injection
🇬🇧
Aetherweb Ark
2026-09-06 03:04:51
(11 hours ago)
(mod_security) mod_security (id:949110) triggered by 35.233.64.162 (BE/Belgium/162.64.233.35.bc.goog ...
show more
(mod_security) mod_security (id:949110) triggered by 35.233.64.162 (BE/Belgium/162.64.233.35.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
Anonymous
2026-09-06 02:58:48
(11 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 35.233.64.162 (BE/Belgium/162.64.233.35.bc.g ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 35.233.64.162 (BE/Belgium/162.64.233.35.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.233.64.162 - - [06/Sep/2026:04:58:43 +0200] "GET /.env.bak HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:04:58:43 +0200] "GET /.env.production HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:04:58:43 +0200] "GET /.env.example HTTP/1.1" 406 4830 "-" "crusader-worker/1.0"
show less
Port Scan
Anonymous
2026-09-06 02:36:02
(11 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.bak HTTP/1.1, GET /.env.local HTTP/1.1, GET /wp-co ...
show more
Bot / scanning and/or hacking attempts: GET /.env.bak HTTP/1.1, GET /.env.local HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /actuator/env HTTP/1.1, GET /env HTTP/1.1, GET /actuator/configprops HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
CBJ
2026-09-06 02:34:16
(11 hours ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇫🇷
✨
2026-09-06 01:47:12
(12 hours ago)
Domain : georgiaschoice.co.uk
Rule : hack
2026-09-06 01:45:37 79.171.39.6 GET /wp-config.php.bak - 8 ...
show more
Domain : georgiaschoice.co.uk
Rule : hack
2026-09-06 01:45:37 79.171.39.6 GET /wp-config.php.bak - 80 - 35.233.64.162 HTTP/1.1 crusader-worker/1.0 - georgiaschoice.co.uk 301 0 0 410 109 10 - -
show less
Hacking
SQL Injection
Brute-Force
🇨🇭
zynex
2026-09-06 01:37:30
(12 hours ago)
URL Probing: /wp-config.php.bak
Web App Attack
🇯🇵
Green_
2026-09-06 01:25:50
(13 hours ago)
fail2ban pubweb-trap ban
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 01:08:36
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.233.64.162 (162.64.233.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.233.64.162 (162.64.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 21:08:28.806914 2026] [security2:error] [pid 18288:tid 18288] [client 35.233.64.162:38812] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lfrmtmorris.com"] [uri "/.env.bak"] [unique_id "apy9DJfk12T3dSkSQMlAegAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-06 01:01:27
(13 hours ago)
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 164 "-" "crusad ...
show more
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /.env.prod HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /storage/logs/laravel.log HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /actuator/configprops HTTP/1.1" 404 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /.env.bak HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /.env.dev HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /.env HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /actuator/env HTTP/1.1" 404 164 "-" "crusader-worker/1.0"
35.233.64.162 - - [06/Sep/2026:03:01:17 +0200] "GET /.env.save HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
35.233.
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Guardian
2026-09-06 00:47:51
(13 hours ago)
Multi abuses [2]: Unauthorized connection attempt / Port scanning (x92), Unauthorized attempt to ret ...
show more
Multi abuses [2]: Unauthorized connection attempt / Port scanning (x92), Unauthorized attempt to retrieve configuration file
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /.claude/.credentials.json HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /.codeium/windsurf/mcp_config.json HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /backup.sql HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /site.zip HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /backup.7z HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /.vscode/mcp.json HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /backup.tar.gz HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /backup.zip HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /web.zip HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /.claude/mcp.json HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /sql.gz HTTP/1.1"
35.233.64.162 [06/Sep/2026:02:47:50 +0200] "GET /dump.sql HTTP/1.1"
35.233.64.162 [06
show less
Port Scan
Web App Attack
🇫🇷
dynamix
2026-09-06 00:21:18
(14 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:56:11
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.233.64.162 (162.64.233.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.233.64.162 (162.64.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:56:03.920803 2026] [security2:error] [pid 27222:tid 27222] [client 35.233.64.162:34556] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "awl-v.com"] [uri "/.env"] [unique_id "apysE8MNk2ke8rRZOnQ_fwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-05 23:25:21
(15 hours ago)
Web attack/malicious scanning detected
Web App Attack