🇺🇸
TPI-Abuse
2026-11-13 02:16:43
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.244.66.205 (205.66.244.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:16:38.523467 2026] [security2:error] [pid 19213:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.244.66.205 (205.66.244.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:16:38.523467 2026] [security2:error] [pid 19213:tid 19213] [client 35.244.66.205:54420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.qwixel2.bridgital.com"] [uri "/.git/config"] [unique_id "avZzBlWQDdDVV7qSpb7dYQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
pipeline.es
2026-11-13 01:21:18
UTC ·
(3 hours ago)
Web scanning / probing for vulnerable paths | URL: /server/.env | Evidence: qwaytravel.com 35.244.66.205 - - [13/Nov/2026:02:20:52 +0100] \"GET /server/.env HTTP/1.1\" 404 29623 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH ...
show more
Web scanning / probing for vulnerable paths | URL: /server/.env | Evidence: qwaytravel.com 35.244.66.205 - - [13/Nov/2026:02:20:52 +0100] \"GET /server/.env HTTP/1.1\" 404 29623 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" GEOIP_COUNTRY_CODE=AU 19448 | ASN: GOOGLE-CLOUD-PLATFORM | Country: AU
show less
Port Scan
Web App Attack
🇫🇷
dynamix
2026-11-13 01:16:32
UTC ·
(3 hours ago)
Multiple WAF Violations
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-12 23:01:08
UTC ·
(5 hours ago)
Auto-ban: >3000 req/min op 2026-11-12
Web App Attack
SSH
Hacking
🇬🇧
consul.to
2026-11-12 21:38:56
UTC ·
(6 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇷🇺
Deynekin.com
2026-11-12 20:09:20
UTC ·
(8 hours ago)
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-11-12T23:09:20+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: ...
show more
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-11-12T23:09:20+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: 1d.
Sample requests/indicators:
GET /.git/config -> 403
GET /.env -> 403
GET /.env.local -> 403
GET /.env.production -> 403
No personal data included.
--
Reported via Fail2Ban_AbuseIPDB Monitor: https://github.com/paulmann/Fail2Ban_AbuseIPDB
show less
Bad Web Bot
Web App Attack
🇩🇪
Séfora Srl
2026-11-12 18:45:14
UTC ·
(9 hours ago)
crowdsecurity/http-sensitive-files detected by CrowdSec
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 18:40:36
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.244.66.205 (205.66.244.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 13:40:30.588024 2026] [security2:error] [pid 8712:tid 8 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.244.66.205 (205.66.244.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 13:40:30.588024 2026] [security2:error] [pid 8712:tid 8712] [client 35.244.66.205:57778] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.quizzersform.cmabiblequizzing.org"] [uri "/.git/config"] [unique_id "avYIHlUQu3MnA-Ujzlxr9gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 15:08:26
UTC ·
(13 hours ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: AU, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 13:44:45
UTC ·
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.244.66.205 (205.66.244.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 08:44:39.854570 2026] [security2:error] [pid 13488:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.244.66.205 (205.66.244.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 08:44:39.854570 2026] [security2:error] [pid 13488:tid 13488] [client 35.244.66.205:46744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rssfeeds.jeremyscraig.com"] [uri "/.git/config"] [unique_id "avXCxy-iSUJrFVoJ5KnPKgAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 13:26:25
UTC ·
(14 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
EGP Abuse Dept
2026-11-12 12:41:56
UTC ·
(15 hours ago)
Scanning for web/db/file exploits on www.roxxoogzorg.nl
SQL Injection
Bad Web Bot
Web App Attack
2026-11-12 12:40:12
UTC ·
(15 hours ago)
| [Dangerous/Australia] Aggressive IP 35.244.66.205 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
2026-11-12 12:26:42
UTC ·
(15 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-12 12:24:08
UTC ·
(15 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
