🇳🇱
Alt255
2026-10-22 16:09:23
UTC ·
(3 weeks ago)
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.241.175.137 - - [22/Oct/2026:18:09:10 +0200] "GET /_nuxt/../.env HTTP/2.0" 404 1422 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbo ...
show more
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.241.175.137 - - [22/Oct/2026:18:09:10 +0200] "GET /_nuxt/../.env HTTP/2.0" 404 1422 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-22 14:40:21
UTC ·
(3 weeks ago)
[cb-09al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.241.175.137 - - [22/Oct/2026:16:40:18 +0200] "GET /register HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl ...
show more
[cb-09al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.241.175.137 - - [22/Oct/2026:16:40:18 +0200] "GET /register HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
35.241.175.137 - - [22/Oct/2026:16:40:18 +0200] "GET /auth/login HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
35.241.175.137 - - [22/Oct/2026:16:40:18 +0200] "GET /billing HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
35.241.175.137 - - [22/Oct/2026:16:40:18 +0200] "GET /gp5pcxlygj951vew112c HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (com
...
show less
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2026-10-22 14:33:39
UTC ·
(3 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from BE.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoint: /settings | UA: Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇩🇪
mondor.ro
2026-10-22 08:43:09
UTC ·
(3 weeks ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 35.241.175.137, Reason:[(mod_security) mod_security (id:210832) triggered by 35.241.175.137 (BE/Belgium/137.175.241.35.bc.googleusercontent.com): 3 in the last 3600 secs]; ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 35.241.175.137, Reason:[(mod_security) mod_security (id:210832) triggered by 35.241.175.137 (BE/Belgium/137.175.241.35.bc.googleusercontent.com): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
🇺🇸
TPI-Abuse
2026-10-22 05:43:11
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:43:04.667842 2026] [security2:error] [pid 27100:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:43:04.667842 2026] [security2:error] [pid 27100:tid 27439] [client 35.241.175.137:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.humanet.io"] [uri "/.env.supabase"] [unique_id "atmiaBbNYurIN2scK_y7-wAAAVU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
hostmach
2026-10-22 05:27:42
UTC ·
(3 weeks ago)
(cpanel) Failed cPanel login from 35.241.175.137 (BE/Belgium/137.175.241.35.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-10-22 01:27:41 -0400] info [cpaneld] 35.241.175.137 - - "GET / ...
show more
(cpanel) Failed cPanel login from 35.241.175.137 (BE/Belgium/137.175.241.35.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-10-22 01:27:41 -0400] info [cpaneld] 35.241.175.137 - - "GET /dist/manifest.json HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-10-22 01:27:41 -0400] info [cpaneld] 35.241.175.137 - - "GET /manifest.json HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-10-22 01:27:41 -0400] info [cpaneld] 35.241.175.137 - - "GET /z9x8c7v6b5-debug-trigger-cpanel.hostmach.com.br HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-10-22 01:27:41 -0400] info [cpaneld] 35.241.175.137 - - "GET /75cl3i7ef7l4dk6xzt27 HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-10-22 01:27:41 -0400] info [cpaneld] 35.241.175.137 - - "GET /webpack-stats.json HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
show less
Brute-Force
SSH
🇨🇭
4server
2026-10-22 05:27:06
UTC ·
(3 weeks ago)
[2026-10-2207:27:01 0200]info[cpaneld]35.241.175.137--\"GET/z9x8c7v6b5-debug-trigger-cpanel.hosting-ticino-svizzera.chHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"POST/api/graphqlHTTP ...
show more
[2026-10-2207:27:01 0200]info[cpaneld]35.241.175.137--\"GET/z9x8c7v6b5-debug-trigger-cpanel.hosting-ticino-svizzera.chHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"POST/api/graphqlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"GET/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ\?raw\?\?HTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"GET/403.shtmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"GET/403.shtmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"GET/403.shtmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:02 0200]info[cpaneld]35.241.175.137--\"GET/@fs/home/ec2-user/.aws/credentials\?raw\?\?HTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2207:27:
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 05:16:27
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:16:23.563708 2026] [security2:error] [pid 15960:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:16:23.563708 2026] [security2:error] [pid 15960:tid 15960] [client 35.241.175.137:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.hollyranch.com"] [uri "/static../.env"] [unique_id "atmcJ6KUcz8cNh3dgsPtqwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
gtheo99
2026-10-22 05:14:05
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:900006) triggered by 35.241.175.137 (BE/Belgium/137.175.241.35.bc.googleusercontent.com): 3 in the last 900 secs (CF_ENABLE)
Port Scan
🇺🇸
TPI-Abuse
2026-10-22 04:54:21
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:54:16.141443 2026] [security2:error] [pid 6308:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:54:16.141443 2026] [security2:error] [pid 6308:tid 6308] [client 35.241.175.137:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.helpsavepets.org"] [uri "/img../.env"] [unique_id "atmW-OeEGGsTz0NKZ_CDogAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
clapper
2026-10-22 04:52:00
UTC ·
(3 weeks ago)
(cpanel) Failed cPanel login from 35.241.175.137 (BE/Belgium/137.175.241.35.bc.googleusercontent.com): 5 in the last 3600 secs; ID: LUC
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-22 04:19:42
UTC ·
(3 weeks ago)
[2026-10-2206:19:37 0200]info[cpaneld]35.241.175.137--\"GET/asset-manifest.jsonHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2206:19:38 0200]info[cpaneld]35.241.175.137--\"GET/@fs/root/.env\?raw\?\?HTTP/1.1\"FAILEDLOGINcpaneld:logi ...
show more
[2026-10-2206:19:37 0200]info[cpaneld]35.241.175.137--\"GET/asset-manifest.jsonHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2206:19:38 0200]info[cpaneld]35.241.175.137--\"GET/@fs/root/.env\?raw\?\?HTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2206:19:38 0200]info[cpaneld]35.241.175.137--\"GET/404.shtmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2206:19:38 0200]info[cpaneld]35.241.175.137--\"GET/_image\?href=/../../../.envHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-10-2206:19:38 0200]info[cpaneld]35.241.175.137--\"GET/pages/api/index.astro.mjs.mapHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 04:00:42
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:00:34.936228 2026] [security2:error] [pid 15529:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:00:34.936228 2026] [security2:error] [pid 15529:tid 15529] [client 35.241.175.137:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.gregquinn.com"] [uri "/public/.env"] [unique_id "atmKYl2VEKkj8qNwVy69qQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
IVski.com
2026-10-22 01:33:44
UTC ·
(3 weeks ago)
IVski WAF | Sensitive file probe detected - looking for config, backups or credentials
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 22:31:08
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 18:31:02.212812 2026] [security2:error] [pid 20066:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 35.241.175.137 (137.175.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 18:31:02.212812 2026] [security2:error] [pid 20066:tid 20066] [client 35.241.175.137:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||backend.grainavi.com|F|2"] [data ".grainavi.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "backend.grainavi.com"] [uri "/z9x8c7v6b5-debug-trigger-backend.grainavi.com"] [unique_id "atk9JrBcpS8VpQFV8glJngAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
