🇳🇱
homeshowdomain.nl
2026-06-14 22:01:59
(4 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-13.
show less
Web App Attack
SSH
Hacking
🇺🇸
mnsf
2026-06-14 00:08:06
(5 days ago)
Scanning/Probing (61)
Request Overload (383)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-06-13 22:01:58
(5 days ago)
Auto-ban: >3000 req/min op 2026-06-13
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-06-13 17:29:32
(6 days ago)
(mod_security) mod_security (id:210831) triggered by 130.211.109.219 (219.109.211.130.bc.googleuserc ...
show more
(mod_security) mod_security (id:210831) triggered by 130.211.109.219 (219.109.211.130.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 13:29:25.833649 2026] [security2:error] [pid 952:tid 952] [client 130.211.109.219:57214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||mail.exp.com.tr|F|4"] [data "EmailWolf"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "mail.exp.com.tr"] [uri "/v1/actuator/env"] [unique_id "ai2TddhHDieRVEmlwKnTXwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-06-13 16:29:46
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇺🇸
TPI-Abuse
2026-06-13 15:37:24
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 130.211.109.219 (219.109.211.130.bc.googleuserc ...
show more
(mod_security) mod_security (id:210730) triggered by 130.211.109.219 (219.109.211.130.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 11:37:18.893716 2026] [security2:error] [pid 21870:tid 21896] [client 130.211.109.219:39418] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.plasticsurgeryjournal.aafm.us|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.plasticsurgeryjournal.aafm.us"] [uri "/.config/gcloud/credentials.db"] [unique_id "ai15Loi7cogPshLeKsFvSwAAAJg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
DEV-DNS
2026-06-13 14:52:43
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇫🇷
Octopuce
2026-06-13 13:36:37
(6 days ago)
Aggressive web search of vulnerable pages: /deploy/docker-compose.prod.yml /infra/docker-compose.yml ...
show more
Aggressive web search of vulnerable pages: /deploy/docker-compose.prod.yml /infra/docker-compose.yml /devops/docker-compose.yml /infrastructure ...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 11:15:18
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 130.211.109.219 (219.109.211.130.bc.googleuserc ...
show more
(mod_security) mod_security (id:210730) triggered by 130.211.109.219 (219.109.211.130.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 07:15:13.199489 2026] [security2:error] [pid 8477:tid 8477] [client 130.211.109.219:37594] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.delidalga.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.delidalga.com"] [uri "/database.ini"] [unique_id "ai07wZTNq6sFhV3twyt6PgAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-13 09:05:58
(6 days ago)
Logfile match
Web App Attack
2026-06-13 04:21:44
(6 days ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇮🇹
VHosting
2026-06-13 03:55:03
(6 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-06-13 03:31:53
(6 days ago)
Web attack/malicious scanning detected
Web App Attack