2026-10-29 00:43:20
UTC ·
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇬🇧
oja
2026-10-26 09:02:20
UTC ·
(1 week ago)
Aggressive web scanner
Web App Attack
🇨🇭
Masterpiece
2026-10-26 08:07:02
UTC ·
(1 week ago)
Web scanning (http-sensitive-files), 5 requests.
Web App Attack
🇨🇭
Masterpiece
2026-10-26 07:50:06
UTC ·
(1 week ago)
Web scanner probing for non-existent paths (wp-login, .env, xmlrpc and similar). 5 requests within one hour.
Web App Attack
🇬🇧
andypiper
2026-10-26 02:00:44
UTC ·
(1 week ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-26 01:15:46
UTC ·
(1 week ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.242.192.89 - - [26/Oct/2026:02:15:38 +0100] "GET /.env.supabase HTTP/2.0" 301 512 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWe ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.242.192.89 - - [26/Oct/2026:02:15:38 +0100] "GET /.env.supabase HTTP/2.0" 301 512 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
masterguru
2026-10-26 00:11:13
UTC ·
(1 week ago)
BAD BOT - Detected and Blocked.. Matched phrase "ChatGPT-User" at REQUEST_HEADERS:user-agent. (1100000-164)
Bad Web Bot
🇩🇪
4server
2026-10-25 21:36:24
UTC ·
(1 week ago)
[2026-10-2522:36:18 0100]info[webmaild]35.242.192.89--\"GET/sitemap.xmlHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-10-2522:36:20 0100]info[webmaild]35.242.192.89--\"GET/z9x8c7v6b5-debug-trigger-webmail.modularss.comHTTP/1.1\"FAILED ...
show more
[2026-10-2522:36:18 0100]info[webmaild]35.242.192.89--\"GET/sitemap.xmlHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-10-2522:36:20 0100]info[webmaild]35.242.192.89--\"GET/z9x8c7v6b5-debug-trigger-webmail.modularss.comHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-10-2522:36:21 0100]info[webmaild]35.242.192.89--\"GET/.git/HEADHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-10-2522:36:21 0100]info[webmaild]35.242.192.89--\"GET/serviceAccountKey.jsonHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-10-2522:36:21 0100]info[webmaild]35.242.192.89--\"POST/api/graphqlHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
VanKoh
2026-10-25 20:07:24
UTC ·
(1 week ago)
(cpanel) Failed cPanel login from 35.242.192.89 (DE/Germany/Hesse/Frankfurt am Main/89.192.242.35.bc.googleusercontent.com): 5 in the last 3600 secs; IP: 35.242.192.89; Ports: *; Direction: 1; Trigger: LF_TRIGGER; Logs: [2026-10-25 14:07:14 -0600] in ...
show more
(cpanel) Failed cPanel login from 35.242.192.89 (DE/Germany/Hesse/Frankfurt am Main/89.192.242.35.bc.googleusercontent.com): 5 in the last 3600 secs; IP: 35.242.192.89; Ports: *; Direction: 1; Trigger: LF_TRIGGER; Logs: [2026-10-25 14:07:14 -0600] info [webmaild] 35.242.192.89 - - "GET /sitemap.xml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username [2026-10-25 14:07:15 -0600] info [webmaild] 35.242.192.89 - - "GET /z9x8c7v6b5-debug-trigger-webmail.navieraintermar.com HTTP/1.1" FAILED LOGIN webmaild: login attempt without username [2026-10-25 14:07:17 -0600] info [webmaild] 35.242.192.89 - - "GET /files../.env HTTP/1.1" FAILED LOGIN webmaild: login attempt without username [2026-10-25 14:07:17 -0600] info [webmaild] 35.242.192.89 - - "GET /.env HTTP/1.1" FAILED LOGIN webmaild: login attempt without username [2026-10-25 14:07:21 -0600] info [webmaild] 35.242.192.89 - - "GET /api/.env/public/.env HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-10-25 19:48:27
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.242.192.89 (89.192.242.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 15:48:22.855408 2026] [security2:error] [pid 31745:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.242.192.89 (89.192.242.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 15:48:22.855408 2026] [security2:error] [pid 31745:tid 31745] [client 35.242.192.89:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.ndanetworks.com"] [uri "/.env.secret"] [unique_id "at5dBs8cfOhlt6UAb3y1_gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-25 18:53:28
UTC ·
(1 week ago)
Attempted access to sensitive endpoint (/.env.example) detected. Automated scan or unauthorized probing.
Web App Attack
🇩🇪
Hazzard
2026-10-25 17:32:48
UTC ·
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
2026-10-25 17:23:20
UTC ·
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇳🇱
e.fierstra
2026-10-25 17:08:34
UTC ·
(1 week ago)
excessive HTTP 404 errors
Bad Web Bot
🇫🇷
dynamix
2026-10-25 16:55:54
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
