🇩🇪
ghostwarriors
2026-11-06 20:51:00
UTC ·
(5 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-06 20:39:36
UTC ·
(5 hours ago)
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.241.208.67 - - [06/Nov/2026:21:39:29 +0100] "GET /.env.dev.local HTTP/2.0" 403 346 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@b ...
show more
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.241.208.67 - - [06/Nov/2026:21:39:29 +0100] "GET /.env.dev.local HTTP/2.0" 403 346 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
netman
2026-11-06 20:34:23
UTC ·
(5 hours ago)
HTTP: 35.241.208.67 blocked because of 100 failures
...
DDoS Attack
Web App Attack
🇮🇹
VHosting
2026-11-06 20:25:05
UTC ·
(6 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇦🇺
aranguren.org
2026-11-06 20:15:47
UTC ·
(6 hours ago)
35.241.208.67 - - [07/Nov/2026:07:15:46 +1100] "GET /sitemap_index.xml HTTP/2.0" 404 985 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" TLSv1.3 TLS_AES_128_GCM_SHA256
35.241.208.67 - - [07/Nov/2026:07:15:46 +1100] "GET /asset ...
show more
35.241.208.67 - - [07/Nov/2026:07:15:46 +1100] "GET /sitemap_index.xml HTTP/2.0" 404 985 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" TLSv1.3 TLS_AES_128_GCM_SHA256
35.241.208.67 - - [07/Nov/2026:07:15:46 +1100] "GET /assets/manifest.json HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36" TLSv1.3 TLS_AES_128_GCM_SHA256
35.241.208.67 - - [07/Nov/2026:07:15:46 +1100] "GET /asset-manifest.json HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36" TLSv1.3 TLS_AES_128_GCM_SHA256
...
show less
Bad Web Bot
🇩🇪
Hazzard
2026-11-06 18:11:38
UTC ·
(8 hours ago)
(PERMBLOCK) 35.241.208.67 (BE/Belgium/Brussels Capital/Brussels/67.208.241.35.bc.googleusercontent.com/[redacted]) has had more than 4 temp blocks
Hacking
2026-11-06 17:02:55
UTC ·
(9 hours ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
2026-11-06 16:33:27
UTC ·
(10 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇫🇷
Jimbo67
2026-11-06 16:30:48
UTC ·
(10 hours ago)
Cloudflare WAF: 50 hits in 30s | action=block | abuse=confirmed_abuse | categories=19,21 | rule_id=0189a8c2c2ab4a60bc709bad14577d18 | URIs=/.env.old,/.env.prod,/.env.production,/.env.swp,/.env.test | confidence=0.93
Web App Attack
Bad Web Bot
🇨🇦
alexbfr
2026-11-06 13:32:06
UTC ·
(13 hours ago)
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-11-06T13:32:06Z; reported_at=2026-11-06T13:32:08Z
2026-11-06T13:32:06Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-06T ...
show more
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-11-06T13:32:06Z; reported_at=2026-11-06T13:32:08Z
2026-11-06T13:32:06Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-06T13:32:06Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-06T13:32:06Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-06T13:32:06Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-06T13:32:06Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
show less
Web App Attack
🇫🇷
j-tap
2026-11-06 11:14:47
UTC ·
(15 hours ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
🇩🇪
Hazzard
2026-11-06 11:03:24
UTC ·
(15 hours ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇺🇸
TPI-Abuse
2026-11-06 10:39:46
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.208.67 (67.208.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:39:41.359445 2026] [security2:error] [pid 7799:tid 7 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.208.67 (67.208.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:39:41.359445 2026] [security2:error] [pid 7799:tid 7799] [client 35.241.208.67:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ard.global"] [uri "/.env.staging.local"] [unique_id "au2ubcx_O3u1szisUsprAAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-06 10:38:46
UTC ·
(15 hours ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.241.208.67 - - \[06/Nov/2026:11:38:31 +0100\] "GET /.env.keys HTTP/1.1" 403 2064 "-" "Mozilla/5.0 \(compatible\; Bravebot/1.0\; +https://brave.com/sea ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.241.208.67 - - \[06/Nov/2026:11:38:31 +0100\] "GET /.env.keys HTTP/1.1" 403 2064 "-" "Mozilla/5.0 \(compatible\; Bravebot/1.0\; +https://brave.com/search/\)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
oralunal
2026-11-06 10:16:29
UTC ·
(16 hours ago)
Banned by Fail2Ban - access.log - mavifinds
Web App Attack
Bad Web Bot
