🇧🇪
cmbplf
2026-09-24 11:52:01
(1 week ago)
220 requests with url.path */auth.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-24 09:20:39
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 05:20:33.730213 2026] [security2:error] [pid 13001:tid 13001] [client 34.101.224.29:48348] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||canadagreenrecycling.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "canadagreenrecycling.com"] [uri "/.codex/auth.json.bak"] [unique_id "arTrYX1UcFJftdJbFEujJQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-09-24 08:48:06
(1 week ago)
Bruteforce
Bad Web Bot
🇳🇱
WeCloudit-Anti-Abuse
2026-09-24 06:54:20
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
SCHAPPY
2026-09-24 06:43:55
(1 week ago)
Malicious activity from IP detected: crowdsecurity/http-probing.
Web App Attack
Hacking
🇧🇾
lns.bz
2026-09-24 03:35:36
(1 week ago)
Too many 404 requests [BY]
Web App Attack
2026-09-22 09:20:12
(1 week ago)
| Suspicious URL access.
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-09-22 08:21:41
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 04:21:35.295042 2026] [security2:error] [pid 28107:tid 28107] [client 34.101.224.29:52482] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||iplayriichi.com|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "iplayriichi.com"] [uri "/.codex/auth.json.old"] [unique_id "arI6j1iQUtXtqBsq-_hVvwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-22 08:05:04
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 07:41:15
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 03:41:12.050932 2026] [security2:error] [pid 27380:tid 27380] [client 34.101.224.29:59358] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||yareblooms.click|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "yareblooms.click"] [uri "/.codex/auth.json.old"] [unique_id "arIxGFgocLBLdUOuX0XKFwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 07:17:40
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 03:17:32.693355 2026] [security2:error] [pid 3348:tid 3348] [client 34.101.224.29:49940] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.safekit.abecasis.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.safekit.abecasis.com"] [uri "/.codex/auth.json.bak"] [unique_id "arIrjCdPJ2MQZJ2rsZPSJwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 06:37:36
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-22 06:32:04
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.101.224.29 (29.224.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 02:32:00.683581 2026] [security2:error] [pid 32065:tid 32065] [client 34.101.224.29:50110] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||smoothiessoupssalads.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "smoothiessoupssalads.com"] [uri "/.codex/auth.json.bak"] [unique_id "arIg4INix-d9gZuwjBg-jgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-05-08 14:22:40
(4 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
