🇳🇱
homeshowdomain.nl
2026-08-28 22:02:43
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-27.
show less
Web App Attack
SSH
Hacking
🇳🇱
homeshowdomain.nl
2026-08-27 21:59:34
(4 days ago)
Auto-ban: >3000 req/min op 2026-08-27
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-08-27 14:04:06
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 35.237.7.124 (124.7.237.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.7.124 (124.7.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:04:00.810812 2026] [security2:error] [pid 2564:tid 2564] [client 35.237.7.124:38280] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nccb.org"] [uri "/.env.example"] [unique_id "apBD0Du9DOnHApFl7uXxDwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-08-27 13:59:16
(4 days ago)
Scanning for exploits - /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 13:16:40
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.237.7.124 (124.7.237.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.7.124 (124.7.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 09:16:35.273892 2026] [security2:error] [pid 22813:tid 22813] [client 35.237.7.124:45532] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "donaldcoleman.com"] [uri "/.env.bak"] [unique_id "apA4szrJ4Io7oJV8wQJUlQAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
gadix
2026-08-27 12:48:46
(5 days ago)
[27/Aug/2026:14:48:45.678897 +0200] apAyLT0uOXIrZQMvSXD5cQAAAA0 35.237.7.124 47196 127.0.0.1 7081
[2 ...
show more
[27/Aug/2026:14:48:45.678897 +0200] apAyLT0uOXIrZQMvSXD5cQAAAA0 35.237.7.124 47196 127.0.0.1 7081
[27/Aug/2026:14:48:45.682300 +0200] apAyLT0uOXIrZQMvSXD5cgAAABc 35.237.7.124 47208 127.0.0.1 7081
[27/Aug/2026:14:48:45.684664 +0200] apAyLT0uOXIrZQMvSXD5cwAAAAM 35.237.7.124 47218 127.0.0.1 7081
...
show less
Web App Attack
🇫🇮
YF
2026-08-27 12:30:53
(5 days ago)
WordPress config file probe
Web App Attack
🇯🇵
Green_
2026-08-27 11:45:40
(5 days ago)
fail2ban pubweb-trap ban
Port Scan
Web App Attack
🇩🇪
FeG Deutschland
2026-08-27 11:38:44
(5 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇩🇪
DEV-DNS
2026-08-27 11:14:39
(5 days ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇮🇹
VHosting
2026-08-27 11:05:03
(5 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-08-27 11:01:04
(5 days ago)
csagent: score 21.0: 404 noise floor x4, secrets grab x2; 1 domain(s) in 0s
Web App Attack
🇬🇧
seniorlinuxadmin
2026-08-27 10:57:12
(5 days ago)
35.237.7.124 - - [26/Aug/2026:14:55:46 +0100] "GET /storage/logs/laravel.log HTTP/1.1" 404 158 "-" " ...
show more
35.237.7.124 - - [26/Aug/2026:14:55:46 +0100] "GET /storage/logs/laravel.log HTTP/1.1" 404 158 "-" "crusader-worker/1.0"
show less
Port Scan
Web App Attack
🇧🇪
cmbplf
2024-12-21 03:58:38
(1 year ago)
136.499 requests in 1 hour (2d11h59m)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2024-12-21 03:44:31
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 35.237.7.124 (124.7.237.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 35.237.7.124 (124.7.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 20 22:44:23.087923 2024] [security2:error] [pid 28203:tid 28203] [client 35.237.7.124:55473] [client 35.237.7.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.stlouisdave.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.stlouisdave.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Z2Y5l8KIfRDSPxW9_1lkvQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack