🇺🇸
Charlesiv
2026-09-07 06:02:42
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /.aws/config
Timestamp: 2026-09-06T22:51:58Z
Ray ID: a3710a99debcfe04
UA: CCBot/2.0 (https://commoncrawl.org/faq/)
show less
Bad Web Bot
🇧🇪
taivas.nl
2026-09-07 04:33:10
(1 week ago)
Many_bad_calls
Web App Attack
🇺🇸
Charlesiv
2026-09-06 22:21:19
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /public/admin.json
Timestamp: 2026-09-06T14:57:12Z
Ray ID: a36e5324fda7ef6c
UA: Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36
show less
Bad Web Bot
2026-09-06 20:26:57
(1 week ago)
Portscan: TCP/8080 (4x), TCP/8443 (4x)
Port Scan
🇬🇧
thetomtaylor.co.uk
2026-09-06 20:06:02
(1 week ago)
Fail2Ban - [RECIDIVE]Repeat offender across multiple jails on recidive ... [ice01]
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-09-06 19:08:02
(1 week ago)
Fail2Ban - [RECIDIVE]Repeat offender across multiple jails on recidive ... [ice02,mx02,wa01,wa02]
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
🇦🇺
foff
2026-09-06 17:19:13
(1 week ago)
Source IP: 35.247.156.30 (SG/Google LLC). Web application attack detected by OWASP CRS (local file i ...
show more
Source IP: 35.247.156.30 (SG/Google LLC). Web application attack detected by OWASP CRS (local file inclusion). Attack observed 2026-09-07T03:19:13+10:00.
show less
Web App Attack
🇳🇱
Savvii
2026-09-06 17:06:28
(1 week ago)
20 attempts against mh-misbehave-ban on hostbilldb2
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-09-06 16:59:17
(1 week ago)
(modsecurity) srv201 ModSecurity 35.247.156.30 (SG/Singapore/30.156.247.35.bc.googleusercontent.com) ...
show more
(modsecurity) srv201 ModSecurity 35.247.156.30 (SG/Singapore/30.156.247.35.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 16:52:47
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.156.30 (30.156.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.156.30 (30.156.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 12:52:40.681739 2026] [security2:error] [pid 11003:tid 11003] [client 35.247.156.30:43866] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "unified-dispatch.com"] [uri "/@fs/../.env"] [unique_id "ap2aWIAon07hI0pRFUDNEwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-06 16:33:16
(1 week ago)
20 attempts against mh-misbehave-ban on guava
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-09-06 16:29:05
(1 week ago)
06/Sep/2026:18:29:04.214373 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
06/Sep/2026:18:29:04.214373 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 35.247.156.30] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.hostench.eu"] [uri "/rclone.conf"] [unique_id
...
show less
Hacking
Web App Attack
2026-09-06 16:26:03
(1 week ago)
Bot / scanning and/or hacking attempts: GET /proc/self/cmdline HTTP/2.0, GET /configuration.php.bak ...
show more
Bot / scanning and/or hacking attempts: GET /proc/self/cmdline HTTP/2.0, GET /configuration.php.bak HTTP/2.0, GET /.env?.svg?.wasm?init HTTP/2.0, GET /.env.local?import&raw HTTP/2.0, GET /@fs/root/.oci/oci_api_key.pem?raw?? HTTP/2.0, GET /api/w/starter/jobs_u/get_log_file/../../../../proc/self/en, GET /userfiles?path=../../.env HTTP/2.0, GET /wp-json HTTP/2.0, GET /config.php.bak HTTP/2.0, GET /storage/.env HTTP/2.0, GET /.env.development?import&raw HTTP/2.0, GET /core/.env HTTP/2.0, GET /auth.json HTTP/2.0, GET /api/.env/public/.env HTTP/2.0, GET /wp-config.old HTTP/2.0, GET /.env?import&raw HTTP/2.0, GET /.env.dev HTTP/2.0, GET /storage/logs/laravel.log HTTP/2.0, GET /.env.swp HTTP/2.0, GET /userfiles?path=../../../../.env HTTP/2.0
show less
Hacking
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-09-06 16:18:01
(1 week ago)
Fail2Ban - [WAF]ModSecurity rule violation on modsecurity ... [ice02]
Hacking
SQL Injection
Web App Attack
🇺🇸
Charlesiv
2026-09-06 14:17:16
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /_profiler/latest
Timestamp: 2026-09-06T12:59:30Z
Ray ID: a36da6ba1e5afc11
UA: Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)
show less
Bad Web Bot