🇧🇪
cmbplf
2026-09-24 11:53:27
(3 weeks ago)
187 requests with url.path */auth.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-24 00:32:34
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 20:32:30.485871 2026] [security2:error] [pid 19228:tid 19228] [client 35.247.141.163:50664] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bayareahiphopforever.org|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bayareahiphopforever.org"] [uri "/.codex/auth.json.bak"] [unique_id "arRvnjbTWcPatydH7kbTWwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-09-23 15:20:20
(3 weeks ago)
35.247.141.163 - - [23/Sep/2026:18:20:03 +0300] "GET /.codex/config.json HTTP/2.0" 301 276 "-" "crus ...
show more
35.247.141.163 - - [23/Sep/2026:18:20:03 +0300] "GET /.codex/config.json HTTP/2.0" 301 276 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:18:20:19 +0300] "GET /.codex/config.json HTTP/2.0" 301 0 "-" "crusader-worker/1.0"
...
show less
Web App Attack
🇳🇱
e.fierstra
2026-09-23 14:55:26
(3 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
🇫🇷
pm33
2026-09-23 14:40:16
(3 weeks ago)
Excessive crawling HTTP 404
Web App Attack
🇳🇱
Alt255
2026-09-23 10:45:22
(3 weeks ago)
[livebd] Excessive 404 errors (web scanning): 27 suspicious requests detected by fail2ban jail apach ...
show more
[livebd] Excessive 404 errors (web scanning): 27 suspicious requests detected by fail2ban jail apache-404. Example: 35.247.141.163 - - [23/Sep/2026:12:45:05 +0200] "GET /.codex/auth.json.txt HTTP/1.1" 404 7874 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:12:45:05 +0200] "GET /root/.codex/auth.json HTTP/1.1" 404 7874 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:12:45:05 +0200] "GET /.config/claude/credentials.json HTTP/1.1" 404 7874 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:12:45:05 +0200] "GET /.codex/auth.json.old HTTP/1.1" 404 7874 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:12:45:05 +0200] "GET /home/.codex/auth.json HTTP/1.1" 404 7874 "-" "crusader-worker/1.0"
3
...
show less
Bad Web Bot
Web App Attack
2026-09-23 10:25:13
(3 weeks ago)
35.247.141.163 - - [23/Sep/2026:10:25:12 +0000] "GET /.codex/auth.json.save HTTP/1.1" 403 4157 "-" " ...
show more
35.247.141.163 - - [23/Sep/2026:10:25:12 +0000] "GET /.codex/auth.json.save HTTP/1.1" 403 4157 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:10:25:12 +0000] "GET /backup/.codex/auth.json HTTP/1.1" 403 4158 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:10:25:12 +0000] "GET /app/.codex/auth.json HTTP/1.1" 403 4157 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:10:25:12 +0000] "GET /root/.codex/auth.json HTTP/1.1" 403 4156 "-" "crusader-worker/1.0"
35.247.141.163 - - [23/Sep/2026:10:25:12 +0000] "GET /.codex/auth.json.bak HTTP/1.1" 403 4156 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
🇫🇷
masterguru
2026-09-23 08:45:26
(3 weeks ago)
Restricted File Access Attempt. Matched phrase "/auth.json" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 06:59:46
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 02:59:41.615722 2026] [security2:error] [pid 2770:tid 2770] [client 35.247.141.163:53876] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||allautousa.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "allautousa.com"] [uri "/.codex/auth.json.bak"] [unique_id "arN43W7Bxe8K5fluGzs_eAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-09-23 05:40:01
(3 weeks ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
WellSpring
2026-09-22 18:52:01
(3 weeks ago)
cache exfil on 661.today/tmp/.codex/auth.json — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇫🇷
masterguru
2026-09-22 08:51:54
(3 weeks ago)
Restricted File Access Attempt. Matched phrase "credentials.json" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 08:30:44
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 04:30:38.579962 2026] [security2:error] [pid 19952:tid 19952] [client 35.247.141.163:47392] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||maffiniandbearce.com|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "maffiniandbearce.com"] [uri "/.codex/auth.json.old"] [unique_id "arI8rsn5hBep3_HkKITWuwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Matthew Ping
2026-09-22 08:15:01
(3 weeks ago)
Excessive connections (DDoS/flood) blocked by CSF CT_LIMIT on wp1.
DDoS Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-09-22 08:13:30
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.141.163 (163.141.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 04:13:23.000031 2026] [security2:error] [pid 1526:tid 1526] [client 35.247.141.163:50884] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.english.art.mavikalem.org|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.english.art.mavikalem.org"] [uri "/.codex/auth.json.bak"] [unique_id "arI4onipHpWm7Kuz4LOCoQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack