🇲🇽
octageeks.com
2026-08-28 04:26:05
UTC ·
(2 months ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-27 22:00:26
UTC ·
(2 months ago)
Auto-ban: >3000 req/min op 2026-08-27
Web App Attack
SSH
Hacking
🇵🇱
itsvic.dev
2026-08-27 21:02:34
UTC ·
(2 months ago)
35.240.182.8 - - [27/Aug/2026:21:02:33 +0000] "109.122.28.203" "GET /.env.save HTTP/1.1" 404 5457 "-" "crusader-worker/1.0"
35.240.182.8 - - [27/Aug/2026:21:02:33 +0000] "109.122.28.203" "GET /.env.bak HTTP/1.1" 404 5457 "-" "crusader-worker/1.0"
35. ...
show more
35.240.182.8 - - [27/Aug/2026:21:02:33 +0000] "109.122.28.203" "GET /.env.save HTTP/1.1" 404 5457 "-" "crusader-worker/1.0"
35.240.182.8 - - [27/Aug/2026:21:02:33 +0000] "109.122.28.203" "GET /.env.bak HTTP/1.1" 404 5457 "-" "crusader-worker/1.0"
35.240.182.8 - - [27/Aug/2026:21:02:33 +0000] "109.122.28.203" "GET /.env HTTP/1.1" 404 5457 "-" "crusader-worker/1.0"
...
show less
Brute-Force
Web App Attack
🇮🇩
Burayot
2026-08-27 19:24:24
UTC ·
(2 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 35.240.182.8 (SG/Singapore/8.182.240.35.bc.googleusercontent.com): 2 in the last 3600 secs
Web App Attack
Anonymous
2026-08-27 17:55:38
UTC ·
(2 months ago)
[TCP/443] Unsolicited connection attempt on a port with no legitimate public service.
Port Scan
Hacking
🇨🇭
4server
2026-08-27 17:48:40
UTC ·
(2 months ago)
[ThuAug2719:48:34.3135002026][security2:error][pid1890476:tid1890599][client35.240.182.8:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720 ...
show more
[ThuAug2719:48:34.3135002026][security2:error][pid1890476:tid1890599][client35.240.182.8:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"duoacaja.com.81-17-25-250.cpanel.site\"][uri\"/.env.bak\"][unique_id\"apB4cls9GabFN6rmwt1nGgAAAVQ\"]
show less
Hacking
Web App Attack
🇮🇩
Burayot
2026-08-27 16:55:31
UTC ·
(2 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 35.240.182.8 (SG/Singapore/8.182.240.35.bc.googleusercontent.com): 1 in the last 3600 secs
Web App Attack
🇷🇴
clauss
2026-08-27 16:24:23
UTC ·
(2 months ago)
35.240.182.8 - - [27/Aug/2026:19:24:21 +0300] "GET /actuator/env HTTP/2.0" 301 0 "-" "crusader-worker/1.0"
35.240.182.8 - - [27/Aug/2026:19:24:22 +0300] "GET /_ignition/health-check HTTP/2.0" 404 7882 "-" "crusader-worker/1.0"
...
Web App Attack
🇳🇱
e.fierstra
2026-08-27 16:18:54
UTC ·
(2 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 15:03:03
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 35.240.182.8 (8.182.240.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 11:02:57.761035 2026] [security2:error] [pid 20873:tid 20 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.240.182.8 (8.182.240.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 11:02:57.761035 2026] [security2:error] [pid 20873:tid 20873] [client 35.240.182.8:57560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "7livesahead.com"] [uri "/.env.old"] [unique_id "apBRoSivfXqq-dbnLo5l1QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 14:34:23
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 35.240.182.8 (8.182.240.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:34:19.197957 2026] [security2:error] [pid 1927:tid 192 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.240.182.8 (8.182.240.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:34:19.197957 2026] [security2:error] [pid 1927:tid 1927] [client 35.240.182.8:58292] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hipstan.com"] [uri "/wp-config.php.bak"] [unique_id "apBK68PdkKYjz9FqBmxBZwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-08-27 13:59:21
UTC ·
(2 months ago)
35.240.182.8 - - [27/Aug/2026:13:59:20 +0000] "GET /.env.local HTTP/1.1" 403 4016 "-" "crusader-worker/1.0"
...
Bad Web Bot
Web App Attack
🇩🇪
Progetto1
2026-08-27 13:48:01
UTC ·
(2 months ago)
Detected via HAProxyScanner at 2026-08-27 13:48:01 UTC on destination port WEB (80/443). Repeated scan / connection.
Port Scan
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-08-27 13:19:41
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 35.240.182.8 (8.182.240.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 09:19:37.905204 2026] [security2:error] [pid 10331:tid 10 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.240.182.8 (8.182.240.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 09:19:37.905204 2026] [security2:error] [pid 10331:tid 10331] [client 35.240.182.8:46728] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nagareinkpaper.es"] [uri "/wp-config.php.swp"] [unique_id "apA5aZu-Dl2DXaTMJ0Q-DQAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
paissangroup
2026-08-27 13:14:36
UTC ·
(2 months ago)
Multiple WAF Violations
Web App Attack