🇵🇹
nuno
2026-06-26 07:37:36
(4 days ago)
35.241.203.235 - - [26/Jun/2026:08:37:34 +0100] host:80 "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Win ...
show more
35.241.203.235 - - [26/Jun/2026:08:37:34 +0100] host:80 "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-" 0.000 -
35.241.203.235 - - [26/Jun/2026:08:37:35 +0100] host:80 "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-" 0.000 -
...
show less
Web App Attack
🇬🇧
essinghigh
2026-06-26 07:26:19
(4 days ago)
IPS Detection: 35.241.203.235 -> DPT: 80
Port Scan
🇺🇸
gu-alvareza
2026-06-26 07:05:53
(4 days ago)
Nmap.Script.Scanner
Port Scan
🇺🇸
Starburst SysOp Team
2026-06-26 06:34:50
(4 days ago)
Found User-Agent associated with security scanner. Matched phrase "nmap" at REQUEST_HEADERS:User-Age ...
show more
Found User-Agent associated with security scanner. Matched phrase "nmap" at REQUEST_HEADERS:User-Agent. (913100-stl2-13)
show less
Hacking
Bad Web Bot
🇺🇸
antlac1
2026-06-26 06:27:17
(4 days ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇩🇪
MaxMeier
2026-06-26 06:12:14
(4 days ago)
35.241.203.235 - - [26/Jun/2026:08:09:59 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT ...
show more
35.241.203.235 - - [26/Jun/2026:08:09:59 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
35.241.203.235 - - [26/Jun/2026:08:09:59 +0200] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03w)\x09\x150\xC1M\xDFr\xD9\x02qt:CM\x7F\xF1t'$[+" 400 150 "-" "-"
35.241.203.235 - - [26/Jun/2026:08:09:59 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
35.241.203.235 - - [26/Jun/2026:08:10:04 +0200] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 400 150 "-" "-"
35.241.203.235 - - [26/Jun/2026:08:10:04 +0200] "\x05\xE6V7n\xC2\xEDd\x97\x89X\xC7\x0F\x1B\xA5\xF2;\xE4c\x1Ah\xF3\xF0\xA4Qd5l\x01\x01\x1D0W\xF3\x1AO\xA5 \xA6\xE9Y\xD2\xC4\xC9z\xC2\xE3\xCD\x8D\xE1gs" 400 150 "-" "
...
show less
Bad Web Bot
Web App Attack
🇺🇸
LotPhantom
2026-06-26 05:43:38
(4 days ago)
35.241.203.235 - - [26/Jun/2026:05:43:10 +0000] "GET / HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows N ...
show more
35.241.203.235 - - [26/Jun/2026:05:43:10 +0000] "GET / HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "0"
...
show less
Web App Attack
🇺🇸
itsnixk
2026-06-26 05:11:40
(5 days ago)
(mod_security) mod_security (id:920350) triggered by 35.241.203.235 (BE/Belgium/235.203.241.35.bc.go ...
show more
(mod_security) mod_security (id:920350) triggered by 35.241.203.235 (BE/Belgium/235.203.241.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Jun 26 01:11:37.649555 2026] [security2:error] [pid 884030:tid 884470] [client 35.241.203.235:61668] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.26.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aj4KCRIo3hpenAbdSIY6qAAAAKs"]
show less
Port Scan
🇨🇭
GAS
2026-06-26 05:00:20
(5 days ago)
Direct IP access.
35.241.203.235 - - [26/Jun/2026:07:00:18 +0200] "\x16\x03" 400 392 "-" "-" "-" "-" ...
show more
Direct IP access.
35.241.203.235 - - [26/Jun/2026:07:00:18 +0200] "\x16\x03" 400 392 "-" "-" "-" "-"
35.241.203.235 - - [26/Jun/2026:07:00:18 +0200] "GET / HTTP/1.1" 402 2747 "-" "Mozilla/5.0 (compatible)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇩🇪
HoneyPotFRI
2026-06-26 04:33:25
(5 days ago)
35.241.203.235 - - [26/Jun/2026:06:33:13 +0200] "x16x03x00x00ix01x00x00ex03x03Ux1CxA7xE4random1rando ...
show more
35.241.203.235 - - [26/Jun/2026:06:33:13 +0200] "x16x03x00x00ix01x00x00ex03x03Ux1CxA7xE4random1random2random3random4x00x00x0Cx00/x00" 400 157 "-" "-"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
patrisei
2026-06-26 04:31:45
(5 days ago)
You are now banned for 10 years by Schiffdorf-West Patrol. Trigger: crowdsecurity/http-probing
Port Scan
Web App Attack
🇺🇸
kosada.com
2026-06-26 04:16:12
(5 days ago)
Web vulnerability probing: / (bogus vhost/SNI)
Web App Attack
🇺🇸
its101
2026-06-26 03:55:05
(5 days ago)
Automated detection by LockdownAccess security system. Attack type(s): scanner. Reason: Nginx: scann ...
show more
Automated detection by LockdownAccess security system. Attack type(s): scanner. Reason: Nginx: scanner (2 hits in 24h). Path targeted: unknown. Blocked in Cloudflare.
show less
Bad Web Bot
Web App Attack
🇺🇸
nyt
2026-06-26 03:20:36
(5 days ago)
Empty UA + error
Web App Attack
🇹🇷
SeczarSecureOps
2026-06-26 02:12:52
(5 days ago)
Auto-blocked by Seczar SecureOps — IPS Web Attack Signature (1 events in 5min) at 2026-06-26 02:12
Web App Attack
Bad Web Bot