🇮🇱
spd.co.il
2026-10-10 23:01:51
(1 day ago)
Web application attack detected
Hacking
Web App Attack
🇧🇪
Savvii
2026-10-09 05:58:32
(3 days ago)
27 attempts against mh-misbehave-ban on exodus
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 05:07:50
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 35.252.164.84 (84.164.252.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.252.164.84 (84.164.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 01:07:43.360351 2026] [security2:error] [pid 16878:tid 16878] [client 35.252.164.84:47340] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||academicaic.com.ltscatering.com|F|2"] [data ".com.ltscatering.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "academicaic.com.ltscatering.com"] [uri "/z9x8c7v6b5-debug-trigger-academicaic.com.ltscatering.com"] [unique_id "ash2n_r4rULmzN1-5QYYrgAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
mnazibo
2026-10-09 04:30:10
(3 days ago)
Date: Oct 09 07:01:11 2026 EAT | Reported IP: 35.252.164.84 mod_security | id: 920450 949110 920440 ...
show more
Date: Oct 09 07:01:11 2026 EAT | Reported IP: 35.252.164.84 mod_security | id: 920450 949110 920440 930120 930130 932160 934100 934130 942550 930100 930110 911100 920420 933160 933100 933120 933140 933150 | US/usernameab.my_domain/- | Connections: 1 | Blocked: Permanent Block: [LF_MODSEC] | Logs: ; HTTP header is restricted by policy (/x-middleware-subrequest/); Inbound Anomaly Score Exceeded (Total Score: 5); URL file extension is restricted by policy; HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (/x-middleware-subrequest/); HTTP header is restricted by policy (
show less
SQL Injection
Brute-Force
Bad Web Bot
🇩🇪
webanyone
2026-10-09 03:58:28
(3 days ago)
Wordlist path sweep | method: GET, POST | path: /c9io2u59bcjuwl0imtxf, /static/manifest.json, /webpa ...
show more
Wordlist path sweep | method: GET, POST | path: /c9io2u59bcjuwl0imtxf, /static/manifest.json, /webpack-stats.json (+3 more) | ua: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] ), Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36, Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] ) (+1 more)
show less
Port Scan
Web App Attack
🇺🇸
wbsouza
2026-10-09 03:29:28
(3 days ago)
CrowdSec: crowdsecurity/appsec-vpatch — automated firewall drops on self-hosted IDS sensor
Hacking
🇫🇷
✨
2026-10-09 02:50:10
(3 days ago)
Domain : a62.ability6.com
Rule : env
2026-10-09 02:49:17 ***hidden-privacy*** GET /files../.env - 44 ...
show more
Domain : a62.ability6.com
Rule : env
2026-10-09 02:49:17 ***hidden-privacy*** GET /files../.env - 443 - 35.252.164.84 HTTP/2 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; https://openai.com/bot - a62.ability6.com 404 0 2 1110 440 189 - -
show less
Hacking
SQL Injection
🇺🇸
WizardsToolkit
2026-10-09 02:28:43
(3 days ago)
tried to access forbidden files; attempted to access /@fs/app/.env?raw??
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 02:23:49
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 35.252.164.84 (84.164.252.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.252.164.84 (84.164.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:23:46.557513 2026] [security2:error] [pid 13838:tid 13838] [client 35.252.164.84:37282] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||waggonerfinancial.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "waggonerfinancial.com"] [uri "/z9x8c7v6b5-debug-trigger-waggonerfinancial.com"] [unique_id "ashQMoj2SHbzK3tfZ-03pQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-09 02:22:29
(3 days ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
tmiland
2026-10-09 02:09:20
(3 days ago)
(nginx_444) Nginx 444 35.252.164.84 (US/United States/84.164.252.35.bc.googleusercontent.com): 5 in ...
show more
(nginx_444) Nginx 444 35.252.164.84 (US/United States/84.164.252.35.bc.googleusercontent.com): 5 in the last 3600 secs; IP: 35.252.164.84; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.252.164.84 - - [09/Oct/2026:04:09:16 +0200] "POST /lib/terminal-xhr.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" 35.252.164.84 - - [09/Oct/2026:04:09:16 +0200] "GET /in3nrxnu7y5lulqernuh HTTP/1.1" 444 0 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 35.252.164.84 - - [09/Oct/2026:04:09:16 +0200] "GET /proc/self/cgroup HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" 35.252.164.84 - - [09/Oct/2026:04:09:17 +0200] "GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" 35.252.164.84 - - [09/Oct/2026:04:09:17 +0200] "G
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-10-09 02:00:54
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 35.252.164.84 (84.164.252.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.252.164.84 (84.164.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:00:47.477951 2026] [security2:error] [pid 31184:tid 31184] [client 35.252.164.84:50452] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||taskmasterstech.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "taskmasterstech.com"] [uri "/z9x8c7v6b5-debug-trigger-taskmasterstech.com"] [unique_id "ashKz0gEvSHGZHcw_bil3gAAADY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-09 01:34:09
(3 days ago)
20 attempts against mh-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
RLDD
2026-10-09 01:17:02
(3 days ago)
WP probing for vulnerabilities -nov
Web App Attack
🇫🇷
Baking333
2026-10-09 01:12:57
(3 days ago)
[redacted] 35.252.164.84 - - [09/Oct/2026:02:12:54 +0100] "GET /@fs/app/.env?raw?? HTTP/2.0" 301 60 ...
show more
[redacted] 35.252.164.84 - - [09/Oct/2026:02:12:54 +0100] "GET /@fs/app/.env?raw?? HTTP/2.0" 301 60 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@[redacted])" [redacted] 35.252.164.84 - - [09/Oct/2026:02:12:55 +0100] "GET /@fs/src/.env?raw?? HTTP/2.0" 301 83 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://[redacted]/gptbot"
show less
Bad Web Bot
Web App Attack
