🇳🇱
homeshowdomain.nl
2026-09-29 22:00:41
UTC ·
(1 month ago)
Auto-ban: >3000 req/min op 2026-09-29
Web App Attack
SSH
Hacking
🇺🇦
URAN Publishing Service
2026-09-29 18:34:54
UTC ·
(1 month ago)
[29/Sep/2026:21:34:53 +0300] -- 35.237.127.35 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/config HTTP/1.1
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-09-29 13:29:00
UTC ·
(1 month ago)
2026-09-29 15:26:02 GET /.git/config [301] && 2026-09-29 15:26:03 GET /.env [301] && 2026-09-29 15:26:06 GET /.env.bak [301] && 223 more within 20 minutes
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 06:11:30
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.237.127.35 (35.127.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 02:11:23.719532 2026] [security2:error] [pid 4654:tid 4 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.127.35 (35.127.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 02:11:23.719532 2026] [security2:error] [pid 4654:tid 4654] [client 35.237.127.35:45188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "micasafrontgate.joepaladino.com"] [uri "/.git/config"] [unique_id "artWizdBBcZaRybzhjX20wAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-09-26 21:54:31
UTC ·
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 35.237.127.35 (US/United States/South Carolina/North Charleston/35.127.237.35.bc.googleusercontent.com)
SQL Injection
🇪🇸
pepitogrillo
2026-09-26 19:53:04
UTC ·
(1 month ago)
[Sat Sep 26 19:53:03.877527 2026] [proxy_fcgi:error] [pid 136214] [client 35.237.127.35:56198] AH01071: Got error 'Primary script unknown'
[Sat Sep 26 19:53:04.006136 2026] [proxy_fcgi:error] [pid 136214] [client 35.237.127.35:56198] AH01071: Got err ...
show more
[Sat Sep 26 19:53:03.877527 2026] [proxy_fcgi:error] [pid 136214] [client 35.237.127.35:56198] AH01071: Got error 'Primary script unknown'
[Sat Sep 26 19:53:04.006136 2026] [proxy_fcgi:error] [pid 136214] [client 35.237.127.35:56198] AH01071: Got error 'Primary script unknown'
[Sat Sep 26 19:53:04.138020 2026] [proxy_fcgi:error] [pid 136214] [client 35.237.127.35:56198] AH01071: Got error 'Primary script unknown'
...
show less
DNS Compromise
DNS Poisoning
Fraud Orders
DDoS Attack
Ping of Death
Phishing
Fraud VoIP
Open Proxy
Web Spam
Email Spam
Port Scan
Hacking
SQL Injection
Bad Web Bot
Exploited Host
Web App Attack
IoT Targeted
🇺🇸
TPI-Abuse
2026-09-26 08:48:46
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 35.237.127.35 (35.127.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 04:48:40.977743 2026] [security2:error] [pid 25224:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.127.35 (35.127.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 04:48:40.977743 2026] [security2:error] [pid 25224:tid 25224] [client 35.237.127.35:33754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "miss-ma.com"] [uri "/.git/config"] [unique_id "areG6CRsjEaKQJ6Gmd3s6AAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-25 19:01:06
UTC ·
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-09-24 18:32:13
UTC ·
(1 month ago)
Excessive 404/403 errors
Brute-Force
🇩🇪
grassau.com
2026-09-24 18:11:56
UTC ·
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 35.237.127.35 (US/United States/South Carolina/North Charleston/35.127.237.35.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-09-24 18:00:22
UTC ·
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 35.237.127.35 (35.127.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 14:00:15.519184 2026] [security2:error] [pid 25144:tid ...
show more
(mod_security) mod_security (id:949110) triggered by 35.237.127.35 (35.127.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 14:00:15.519184 2026] [security2:error] [pid 25144:tid 25144] [client 35.237.127.35:43744] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "playground.freedrm.org"] [uri "/.git/config"] [unique_id "arVlL_4oM-t-N2UXSFwb0gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-09-24 17:09:47
UTC ·
(1 month ago)
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths.
Hacking
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-09-22 00:14:19
UTC ·
(1 month ago)
csagent: score 20.0: secrets grab x2; 1 domain(s) in 1s
Web App Attack
🇺🇸
Epimetheus
2026-09-21 15:28:34
UTC ·
(1 month ago)
Zombie network / Bot scanner detected:
[GET] /includes/phpinfo.php
[GET] /core/phpinfo.php
[GET] /wp-json/gravitysmtp/v1/tests/mock-data
[GET] /public/phpinfo.php
[GET] /phpinfo.php.bak
[GET] /php-info.php
[GET] /brevo/.env
[GET] /admin-panel/.env
[ ...
show more
Zombie network / Bot scanner detected:
[GET] /includes/phpinfo.php
[GET] /core/phpinfo.php
[GET] /wp-json/gravitysmtp/v1/tests/mock-data
[GET] /public/phpinfo.php
[GET] /phpinfo.php.bak
[GET] /php-info.php
[GET] /brevo/.env
[GET] /admin-panel/.env
[GET] /uploads/.env
[GET] /.env.yml
[GET] /wp/.env
[GET] /.env.dist
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Bad Web Bot
Exploited Host
Web App Attack
🇳🇱
Alt255
2026-09-21 07:19:45
UTC ·
(1 month ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.237.127.35 - - [21/Sep/2026:09:19:41 +0200] "GET /.git/config HTTP/1.1" 404 122999 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KH ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.237.127.35 - - [21/Sep/2026:09:19:41 +0200] "GET /.git/config HTTP/1.1" 404 122999 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
