🇨🇭
copestack
2026-09-02 22:00:06
(8 hours ago)
Automated detection: HTTP environment file enumeration (.env credential harvesting). 1 decisions on ...
show more
Automated detection: HTTP environment file enumeration (.env credential harvesting). 1 decisions on ov-4e5936.
show less
Web App Attack
🇺🇸
Charlesiv
2026-09-02 16:00:34
(14 hours ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /app/.git/config
Timestamp: 2026-09-02T14:29:20Z
Ray ID: a34d34d00d989af3
UA: crusader-worker/1.0
show less
Bad Web Bot
🇺🇸
mnsf
2026-09-02 14:05:10
(16 hours ago)
Scanning/Probing (24)
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-09-02 11:00:02
(19 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 07:25:04
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 03:24:59.765531 2026] [security2:error] [pid 12736:tid 12743] [client 35.238.118.61:39238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "royalbusinesscollege.com"] [uri "/.git/config"] [unique_id "apfPS7TQe7b0xaoUZU9zJQAAAUM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SwinT
2026-09-02 06:00:21
(1 day ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 05:52:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 01:52:15.587923 2026] [security2:error] [pid 11555:tid 11555] [client 35.238.118.61:48986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.goodneighborvillage.org"] [uri "/var/www/.git/config"] [unique_id "ape5jwPrjulzAbV543TB0wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-02 05:25:06
(1 day ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇺🇸
TPI-Abuse
2026-09-02 05:23:25
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 01:23:19.695231 2026] [security2:error] [pid 15928:tid 15928] [client 35.238.118.61:55204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.ibermar.info"] [uri "/src/.git/config"] [unique_id "apeyx64Zr4E57aN2FyxfTgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
stinpriza
2026-09-02 05:03:14
(1 day ago)
common Web Exploits being scanned
Web App Attack
🇩🇪
FD-IX
2026-09-02 04:54:44
(1 day ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 04:40:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.238.118.61 (61.118.238.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 00:40:03.722640 2026] [security2:error] [pid 11457:tid 11457] [client 35.238.118.61:50010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.nutandboltguy.com"] [uri "/api/.git/config"] [unique_id "apeooxuPz3BLowR_jdNB8wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ISPLtd
2026-09-02 04:05:11
(1 day ago)
Sep 1 22:05:09 35.238.118.61 TCP SPT=40742 DPT=443 SYN
Sep 1 22:05:09 35.238.118.61 TCP SPT=40724 ...
show more
Sep 1 22:05:09 35.238.118.61 TCP SPT=40742 DPT=443 SYN
Sep 1 22:05:09 35.238.118.61 TCP SPT=40724 DPT=443 SYN
Sep 1 22:05:09 35.238.118.61 TCP SPT=40740 DPT=443
...
show less
DDoS Attack
🇫🇷
service Informatique
2026-09-02 04:00:37
(1 day ago)
GET /wp-config
Web App Attack
🇬🇧
consul.to
2026-09-02 03:22:56
(1 day ago)
Web attack/malicious scanning detected
Web App Attack