🇺🇸
TPI-Abuse
2026-10-05 11:23:24
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:23:21.096965 2026] [security2:error] [pid 16364:tid 16364] [client 35.236.152.158:34714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.zztp.ws"] [uri "/.htpasswd"] [unique_id "asOIqWeCclOysFiMtYHVUAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-05 10:46:37
(5 days ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
EGP Abuse Dept
2026-10-05 10:28:34
(5 days ago)
Scanning for web/db/file exploits on www.mach3blocks.io
SQL Injection
Bad Web Bot
Web App Attack
🇩🇪
MusicLibrary
2026-10-05 10:03:20
(5 days ago)
Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)
Bad Web Bot
Web App Attack
🇫🇷
simpletech.si
2026-10-05 08:44:39
(5 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.236.152.158 (TW/Taiwan/158.152.236.3 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 35.236.152.158 (TW/Taiwan/158.152.236.35.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-10-05 04:40:25
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 00:40:17.785569 2026] [security2:error] [pid 30515:tid 30515] [client 35.236.152.158:46536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pop.ghosted.ws"] [uri "/api/system/fileView"] [unique_id "asMqMRvMIp60IuDpI5ULSgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 02:52:07
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 22:52:04.736282 2026] [security2:error] [pid 9789:tid 9789] [client 35.236.152.158:48642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.smartpost.ws"] [uri "/.htpasswd"] [unique_id "asMQ1HmoAP7dpRsaBXdS8AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 23:31:17
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 19:31:11.538671 2026] [security2:error] [pid 27594:tid 27594] [client 35.236.152.158:41366] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.onward.ws"] [uri "/.htpasswd"] [unique_id "asLhv9gOqB84rs6a-Hg7nwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 22:04:00
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 18:03:53.476103 2026] [security2:error] [pid 27987:tid 27987] [client 35.236.152.158:45702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "assets.kanata.ws"] [uri "/userfiles"] [unique_id "asLNSaOharMNXQyBmn_0IgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-04 20:09:51
(5 days ago)
{"level":"info","ts":1791144310.8269677,"logger":"http.log.access.log0","msg":"handled request","req ...
show more
{"level":"info","ts":1791144310.8269677,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"35.236.152.158","remote_port":"53082","client_ip":"35.236.152.158","proto":"HTTP/2.0","method":"GET","host":"03la.status.updown.io","uri":"/public../.env","headers":{"Accept-Encoding":["gzip"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"],"Accept":["*/*"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"03la.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000156738,"size":0,"status":429,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"],"Server":["Caddy"]}}
{"level":"info","ts":1791144311.6516552,"logger":"http.log.ac
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 19:58:20
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 15:58:15.340557 2026] [security2:error] [pid 15562:tid 15562] [client 35.236.152.158:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webfrog.ws"] [uri "/.env"] [unique_id "asKv1yOIsmNBrxU9Z1Hj9gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇷
vzderic
2026-10-04 19:57:00
(5 days ago)
Brute-Force
Web App Attack
🇪🇸
pipeline.es
2026-10-04 19:55:39
(5 days ago)
Web scanning / probing for vulnerable paths | URL: /.env?.svg?.wasm?init | Evidence: www.unav.ws 35. ...
show more
Web scanning / probing for vulnerable paths | URL: /.env?.svg?.wasm?init | Evidence: www.unav.ws 35.236.152.158 - - [04/Oct/2026:21:54:41 +0200] \"GET /.env?.svg?.wasm?init HTTP/1.1\" 403 206 \"-\" \"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)\" GEOIP_COUNTRY_CODE=TW | ASN: GOOGLE-CLOUD-PLATFORM | Country: TW
show less
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 19:41:33
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.152.158 (158.152.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 15:41:27.774899 2026] [security2:error] [pid 8945:tid 8945] [client 35.236.152.158:59138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "revision.ws"] [uri "/static../.env"] [unique_id "asKr54XHqdEm00zIuBWFzwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-04 19:33:14
(5 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
