🇫🇷
SpaceHost-Server
2026-10-06 22:20:02
(2 weeks ago)
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-05 22:17:30
(2 weeks ago)
Brute-Force
Web App Attack
🇩🇪
macrob
2026-10-05 17:04:35
(2 weeks ago)
2026/10/05 17:04:34 [error] 3671660#3671660: *19664380 access forbidden by rule, client: 35.252.130. ...
show more
2026/10/05 17:04:34 [error] 3671660#3671660: *19664380 access forbidden by rule, client: 35.252.130.138, server: fn.binixo.es, request: "GET /.vite/manifest.json HTTP/2.0", host: "account.smoozy.org"
2026/10/05 17:04:34 [error] 3671660#3671660: *19664383 access forbidden by rule, client: 35.252.130.138, server: fn.binixo.es, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "account.smoozy.org"
2026/10/05 17:04:34 [error] 3671657#3671657: *19664402 access forbidden by rule, client: 35.252.130.138, server: fn.binixo.es, request: "GET /.htpasswd HTTP/2.0", host: "account.smoozy.org"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 16:38:29
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 12:38:22.620535 2026] [security2:error] [pid 11762:tid 11762] [client 35.252.130.138:44978] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wisk.org"] [uri "/.htpasswd"] [unique_id "asPSfmiZ-iAQlgzeJ_IU6gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-05 16:34:15
(2 weeks ago)
2026/10/05 17:34:13 [error] 3069275#3069275: *264281 access forbidden by rule, client: 35.252.130.13 ...
show more
2026/10/05 17:34:13 [error] 3069275#3069275: *264281 access forbidden by rule, client: 35.252.130.138, server: vp-arc.org, request: "GET /.env HTTP/2.0", host: "vp-arc.org"
35.252.130.138 - - [05/Oct/2026:17:34:13 +0100] "GET /.env HTTP/2.0" 403 1045 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
2026/10/05 17:34:13 [error] 3069275#3069275: *264281 access forbidden by rule, client: 35.252.130.138, server: vp-arc.org, request: "GET /files../.env HTTP/2.0", host: "vp-arc.org"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 15:23:47
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:23:40.474323 2026] [security2:error] [pid 14543:tid 14605] [client 35.252.130.138:39994] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "southsideeconomic.org"] [uri "/.htpasswd"] [unique_id "asPA_AChHrA431oChRX4nwAAAYI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-05 15:03:14
(2 weeks ago)
Crawler ignoring refusals | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 ...
show more
Crawler ignoring refusals | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/, Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) | path: /.ssh/id_rsa, /.npmrc
show less
Bad Web Bot
🇦🇲
arm osint
2026-10-05 14:56:07
(2 weeks ago)
Automated web vulnerability scanning: 447 HTTP 4xx probes for sensitive paths (/api/designer/v1/file ...
show more
Automated web vulnerability scanning: 447 HTTP 4xx probes for sensitive paths (/api/designer/v1/file-content, /feast/read-document, /.env.development?raw, /.env.prod). Detected by Wazuh HIDS rule 31151 on a self-hosted web server.
show less
Web App Attack
Brute-Force
🇫🇷
masterguru
2026-10-05 14:50:06
(2 weeks ago)
Restricted File Access Attempt. Matched phrase "/proc/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇩🇪
macrob
2026-10-05 14:43:10
(2 weeks ago)
2026/10/05 14:43:08 [error] 3671661#3671661: *19228847 access forbidden by rule, client: 35.252.130. ...
show more
2026/10/05 14:43:08 [error] 3671661#3671661: *19228847 access forbidden by rule, client: 35.252.130.138, server: fn.binixo.es, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "smoozy.org"
2026/10/05 14:43:08 [error] 3671660#3671660: *19228848 access forbidden by rule, client: 35.252.130.138, server: fn.binixo.es, request: "GET /.vite/manifest.json HTTP/2.0", host: "smoozy.org"
2026/10/05 14:43:08 [error] 3671660#3671660: *19228866 access forbidden by rule, client: 35.252.130.138, server: fn.binixo.es, request: "GET /.htpasswd HTTP/2.0", host: "smoozy.org"
...
show less
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-05 14:16:40
(2 weeks ago)
2026/10/05 15:16:37 [error] 3069275#3069275: *242945 access forbidden by rule, client: 35.252.130.13 ...
show more
2026/10/05 15:16:37 [error] 3069275#3069275: *242945 access forbidden by rule, client: 35.252.130.138, server: simetria.org, request: "GET /_nuxt/../.env HTTP/2.0", host: "simetria.org"
2026/10/05 15:16:38 [error] 3069275#3069275: *242947 access forbidden by rule, client: 35.252.130.138, server: simetria.org, request: "GET /api/orders/..%2f..%2f.env HTTP/2.0", host: "simetria.org"
2026/10/05 15:16:38 [error] 3069275#3069275: *242951 access forbidden by rule, client: 35.252.130.138, server: simetria.org, request: "GET /api/data/..%2f..%2f.env HTTP/2.0", host: "simetria.org"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 13:01:10
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 09:01:05.946214 2026] [security2:error] [pid 27488:tid 27488] [client 35.252.130.138:56244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sebog.org"] [uri "/.htpasswd"] [unique_id "asOfkfkyT3JrvZ9S8VJI8wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-05 12:19:23
(2 weeks ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇩🇪
ardexter
2026-10-05 11:47:48
(2 weeks ago)
Wordpress attack and DDOS
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 11:25:30
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.252.130.138 (138.130.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:25:25.429639 2026] [security2:error] [pid 27539:tid 27539] [client 35.252.130.138:34962] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rwabutazafoundation.org"] [uri "/static//home/user/.env"] [unique_id "asOJJaBO4h30z2ie5Hj3BgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
