|
🇺🇸
[email protected]
|
|
CrowdSec ban: crowdsecurity/unifi-flood-detection (duration: 71h59m59s)
|
Port Scan
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 35.195.27.7 (7.27.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 02:12:27.194634 2026] [security2:error] [pid 740:tid 740] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 35.195.27.7 (7.27.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 02:12:27.194634 2026] [security2:error] [pid 740:tid 740] [client 35.195.27.7:59010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.mrflatpeople.com"] [uri "/config/.env.php"] [unique_id "arDKy5X0l8kdQ0vMbh_u9QAAACo"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
bazter.pro
|
|
Fail2Ban: apache-ratelimit - 20 failures
|
Port Scan
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 35.195.27.7 (7.27.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:26:27.339059 2026] [security2:error] [pid 23562:tid 2356 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.195.27.7 (7.27.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:26:27.339059 2026] [security2:error] [pid 23562:tid 23562] [client 35.195.27.7:41822] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.amybeam.com"] [uri "/@fs/src/.env"] [unique_id "arCHw_D83wFUZXom32kW1AAAABU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
dot.mg
|
|
Bad behaviour
|
Web Spam
|
|
🇺🇸
[email protected]
|
|
CrowdSec ban: crowdsecurity/thinkphp-cve-2018-20062 (duration: 71h59m57s)
|
Port Scan
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 35.195.27.7 (7.27.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:31:48.137842 2026] [security2:error] [pid 10668:tid 1066 ...
show more
(mod_security) mod_security (id:210730) triggered by 35.195.27.7 (7.27.195.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:31:48.137842 2026] [security2:error] [pid 10668:tid 10668] [client 35.195.27.7:49388] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.mrs-data.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.mrs-data.com"] [uri "/host.key"] [unique_id "arBs5OCUHAgu15rRN_pJoAAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
brightenfield
|
|
Web App Attack
|
Web App Attack
|
|
🇫🇷
dynamix
|
|
Multiple WAF Violations
|
Web App Attack
|
|
Anonymous
|
|
IP matched detection query bad paths many.
|
Brute-Force
Web App Attack
|
|
Anonymous
|
|
(mod_security) mod_security triggered on hostname [redacted] 35.195.27.7 (BE/Belgium/7.27.195.35.bc.googleusercontent.com)
|
SQL Injection
|
|
🇳🇱
Alt255
|
|
[ti-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.195.27.7 - - [20/Sep/2026:21:50:59 +0200] "GET /workspace/.env HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/ ...
show more
[ti-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.195.27.7 - - [20/Sep/2026:21:50:59 +0200] "GET /workspace/.env HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
...
show less
|
Bad Web Bot
Web App Attack
|
