🇧🇪
cmbplf
2026-09-30 06:41:07
UTC ·
(1 month ago)
150 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
2026-09-30 04:13:02
UTC ·
(1 month ago)
Bot / scanning and/or hacking attempts: GET /etc/.env HTTP/2.0, GET /%2e%2e/.env HTTP/2.0, GET /admin/_payload.json HTTP/2.0, GET /src/amplifyconfiguration.json HTTP/2.0, GET /@fs/.env?raw?? HTTP/2.0, GET /amplify_outputs.json HTTP/2.0, GET /@fs/root ...
show more
Bot / scanning and/or hacking attempts: GET /etc/.env HTTP/2.0, GET /%2e%2e/.env HTTP/2.0, GET /admin/_payload.json HTTP/2.0, GET /src/amplifyconfiguration.json HTTP/2.0, GET /@fs/.env?raw?? HTTP/2.0, GET /amplify_outputs.json HTTP/2.0, GET /@fs/root/.env?raw?? HTTP/2.0, GET /.docker/.env HTTP/2.0, GET /config.yaml HTTP/2.0, GET /.//.env HTTP/2.0, GET /config.toml HTTP/2.0, GET //.env HTTP/2.0, GET /env.bak HTTP/2.0, GET /api/.env/public/.env HTTP/2.0, GET /config/prod.exs HTTP/2.0, GET /css../.env HTTP/2.0, GET /env.old HTTP/2.0, GET /%2eenv HTTP/2.0, GET /aws-exports.js HTTP/2.0, GET /@fs/proc/self/environ?import&raw?? HTTP/2.0, GET /.env.production.bak HTTP/2.0, GET /amplifyconfiguration.json HTTP/2.0, GET /_payload.json HTTP/2.0, GET /..%2f.env HTTP/2.0, GET /.env.prod.bak HTTP/2.0
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 03:43:35
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 8.229.31.67 (67.31.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 23:43:29.126882 2026] [security2:error] [pid 14686:tid 1468 ...
show more
(mod_security) mod_security (id:210730) triggered by 8.229.31.67 (67.31.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 23:43:29.126882 2026] [security2:error] [pid 14686:tid 14686] [client 8.229.31.67:36644] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||garyrankin.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "garyrankin.com"] [uri "/z9x8c7v6b5-debug-trigger-garyrankin.com"] [unique_id "aryFYUW2mgG4gGWiCzVq0wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-30 02:43:04
UTC ·
(1 month ago)
BAD BOT - Detected and Blocked.. Matched phrase "ccbot" at REQUEST_HEADERS:User-Agent. (1100000-193)
Bad Web Bot
2026-09-30 00:46:23
UTC ·
(1 month ago)
8.229.31.67 - - [30/Sep/2026:02:46:09 +0200] "GET /api/settings HTTP/2.0" 403 317 "http://www.tuningblog.eu/api/settings" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
Web Spam
Blog Spam
Brute-Force
Web App Attack
🇺🇸
gamabe
2026-09-30 00:44:52
UTC ·
(1 month ago)
Detected crowdsecurity/http-sensitive-files attack pattern. Reported by CrowdSec IDS.
Hacking
🇺🇸
Sockets-AR
2026-09-30 00:13:34
UTC ·
(1 month ago)
CrowdSec: HTTP DoS detected (crowdsecurity/http-dos-swithcing-ua) at 2026-09-30T00:13:33.796Z
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 23:12:29
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 8.229.31.67 (67.31.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:12:22.138917 2026] [security2:error] [pid 20111:tid 2011 ...
show more
(mod_security) mod_security (id:210730) triggered by 8.229.31.67 (67.31.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:12:22.138917 2026] [security2:error] [pid 20111:tid 20111] [client 8.229.31.67:48050] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tytiannasanderson.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tytiannasanderson.com"] [uri "/z9x8c7v6b5-debug-trigger-tytiannasanderson.com"] [unique_id "arxF1ksG_Y3KSScN8WPeAAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-29 22:00:42
UTC ·
(1 month ago)
Auto-ban: >3000 req/min op 2026-09-29
Web App Attack
SSH
Hacking
🇺🇸
H24
2026-09-29 21:31:43
UTC ·
(1 month ago)
/firebase-credentials.json /.env /css../.env /assets../.env /media../.env /js../.env /@fs/../.env /@fs/..%2f..%2f..%2f..%2f..%2froot/.env /@fs/proc/self/cwd/.env /public../.env
Web App Attack
2026-09-29 21:30:26
UTC ·
(1 month ago)
XSS Attempt
Hacking
🇫🇷
Cuteminded
2026-09-29 21:22:49
UTC ·
(1 month ago)
Highly suspect IP: triggered honeypot path (graphql)
Web Spam
Bad Web Bot
2026-09-29 21:05:31
UTC ·
(1 month ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-29 20:55:43
UTC ·
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 8.229.31.67 (67.31.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 16:55:38.883364 2026] [security2:error] [pid 28182:tid 2818 ...
show more
(mod_security) mod_security (id:949110) triggered by 8.229.31.67 (67.31.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 16:55:38.883364 2026] [security2:error] [pid 28182:tid 28182] [client 8.229.31.67:33992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "freedrm.org"] [uri "/.env"] [unique_id "arwlyuvBqoG_9C_P3ZNRtwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-29 20:40:12
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
