🇬🇧
Apache
2026-09-19 06:51:07
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.255.185.155 (US/United States/155.185.255.35 ...
show more
(mod_security) mod_security (id:210730) triggered by 35.255.185.155 (US/United States/155.185.255.35.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
show less
Brute-Force
Web App Attack
🇮🇱
spd.co.il
2026-09-19 02:02:16
(3 weeks ago)
Web application attack detected
Hacking
Web App Attack
🇧🇷
dermatovirtual
2026-09-18 22:56:50
(3 weeks ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 131 unauthorized requests recorded between 2026-09-17 22:53:46 UTC and 2026-09-17 22:53:56 UTC (rate: ~131 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-09-17 22:53:55 UTC] IP: 35.255.185.155 - W3C IIS (Port 443): GET /portal/.env -> HTTP 404 [CLIENT: 35.255.185.155]
[2026-09-17 22:53:55 UTC] IP: 35.255.185.155 - W3C IIS (Port 443): GET /cms/.env -> HTTP 404 [CLIENT: 35.255.185.155]
[2026-09-17 22:53:55 UTC] IP: 35.255.185.155 - W3C IIS (Port 443): GET /assets/.env -> HTTP 404 [CLIENT: 35.255.185.155]
show less
Bad Web Bot
Web App Attack
2026-09-18 18:40:05
(3 weeks ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇺🇸
xxkodedxx
2026-09-18 12:34:01
(4 weeks ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 20× edge-block ...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 20× edge-block in 10m window.
Origin: US / AS396982 Google LLC
Active: 12:33:47→12:33:59 UTC
Volume: 130 HTTP req, 122 honeypot probe(s)
Bait taken: /config.json, /wp-json, /temp/.env, /@fs/root/.env?raw??, /tmp/.env
Status mix: 200×88 444×20 404×12 405×7 301×2 499×1
UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
2026-09-18 11:38:14
(4 weeks ago)
35.255.185.155 - - [18/Sep/2026:06:38:07 -0500] "GET /.env.development HTTP/1.1" 403 199 "-" "Mozill ...
show more
35.255.185.155 - - [18/Sep/2026:06:38:07 -0500] "GET /.env.development HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36" 35.255.185.155
35.255.185.155 - - [18/Sep/2026:06:38:07 -0500] "GET /.env.staging HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)" 35.255.185.155
35.255.185.155 - - [18/Sep/2026:06:38:07 -0500] "GET /.env.test HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )" 35.255.185.155
35.255.185.155 - - [18/Sep/2026:06:38:07 -0500] "GET /.env.production.bak HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )" 35.255.185.155
35.255.185.155 - - [18/Sep/2026:06:38:07 -0500] "GET /.env.docker HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible;
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
NXTwoThou
2026-09-18 10:36:48
(4 weeks ago)
account
Web App Attack
🇧🇩
mixmtech
2026-09-18 05:05:00
(4 weeks ago)
This IP is making repeated attack attempts on my website. Excessive crawling/scraping/requests/scan. ...
show more
This IP is making repeated attack attempts on my website. Excessive crawling/scraping/requests/scan. This behavior is consistent with a DDoS attack
show less
DDoS Attack
Brute-Force
Bad Web Bot
Web App Attack
Web Spam
Port Scan
Hacking
🇳🇱
Savvii
2026-09-18 03:24:29
(4 weeks ago)
20 attempts against mh-misbehave-ban on mars
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-18 00:59:19
(4 weeks ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
JLKnoch Software GmbH
2026-09-17 23:17:31
(4 weeks ago)
CrowdSec crowdsecurity/http-probing
Brute-Force
Web App Attack
🇧🇷
dermatovirtual
2026-09-17 22:56:45
(4 weeks ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 131 unauthorized requests recorded between 2026-09-17 22:53:46 UTC and 2026-09-17 22:53:56 UTC (rate: ~131 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-09-17 22:53:55 UTC] IP: 35.255.185.155 - W3C IIS (Port 443): GET /portal/.env -> HTTP 404 [CLIENT: 35.255.185.155]
[2026-09-17 22:53:55 UTC] IP: 35.255.185.155 - W3C IIS (Port 443): GET /cms/.env -> HTTP 404 [CLIENT: 35.255.185.155]
[2026-09-17 22:53:55 UTC] IP: 35.255.185.155 - W3C IIS (Port 443): GET /assets/.env -> HTTP 404 [CLIENT: 35.255.185.155]
show less
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-17 22:30:04
(4 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-17 22:22:53
(4 weeks ago)
Brute-Force
Web App Attack
🇺🇸
Secure Gateway®️
2026-09-17 22:00:26
(4 weeks ago)
Report By Secure Gateway Security Team: Suspicious File Upload Attempt
Hacking