πΊπΈ
mnsf
2026-06-09 00:16:51
(3 days ago)
Scanning/Probing (61)
Request Overload (383)
Brute-Force
Web App Attack
π¬π§
Apache
2026-06-08 15:53:03
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (JP/Japan/176.203.104.34.bc.goog ...
show more
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (JP/Japan/176.203.104.34.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
show less
Brute-Force
Email Spam
Web App Attack
π«π·
dynamix
2026-06-08 15:44:28
(4 days ago)
Multiple WAF Violations
Web App Attack
π©πͺ
big-cloud.nl
2026-06-08 14:59:09
(4 days ago)
Try to access /.aws/config
Web App Attack
π§πΎ
lns.bz
2026-06-08 14:55:10
(4 days ago)
Too many 404 requests [BY]
Web App Attack
πΊπΈ
TPI-Abuse
2026-06-08 13:15:21
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (176.203.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (176.203.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 09:15:10.652533 2026] [security2:error] [pid 19215:tid 19215] [client 34.104.203.176:49338] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.alecmcatee.robertmcatee.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.alecmcatee.robertmcatee.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aibAXvBJqwBZMiD9_rzM1AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-06-08 12:50:03
(4 days ago)
| Suspicious URL access.
Web App Attack
Hacking
SQL Injection
Anonymous
2026-06-08 11:03:47
(4 days ago)
(caddyscan) Scanner path probe from 34.104.203.176 (JP/Japan/176.203.104.34.bc.googleusercontent.com ...
show more
(caddyscan) Scanner path probe from 34.104.203.176 (JP/Japan/176.203.104.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:11:03:44 +0000] "GET /api/actuator/logfile HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:11:03:44 +0000] "GET /app/actuator/heapdump HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:11:03:44 +0000] "GET /actuator/env HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:11:03:44 +0000] "GET /app/actuator/configprops HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:11:03:44 +0000] "GET /app/actuator/env HTTP/1.1"
show less
Port Scan
π³π±
Site.eu
2026-06-08 09:33:03
(4 days ago)
Excessive 404/403 errors
Brute-Force
π©πͺ
updown.io
2026-06-08 08:33:08
(4 days ago)
{"level":"info","ts":1780907584.5214844,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1780907584.5214844,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.104.203.176","remote_port":"45726","client_ip":"34.104.203.176","proto":"HTTP/1.1","method":"GET","host":"hgfeupdate.update.vutsrqporqpsrqponmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.aws/config","headers":{"User-Agent":["Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.267 Mobile Safari/534.11+"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.000082747,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://hgfeupdate.update.vutsrqporqpsrqponmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.aws/config"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"info","ts":1780907584.8073041,"logger":"http.log.access.log1","msg":"handled request","request":{"remo
...
show less
DDoS Attack
Web App Attack
Anonymous
2026-06-08 07:48:29
(4 days ago)
Multiple web server 400 error codes from same source ip
Web App Attack
Anonymous
2026-06-08 05:58:57
(4 days ago)
(caddyscan) Scanner path probe from 34.104.203.176 (JP/Japan/176.203.104.34.bc.googleusercontent.com ...
show more
(caddyscan) Scanner path probe from 34.104.203.176 (JP/Japan/176.203.104.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:05:58:53 +0000] "GET /api/actuator/configprops HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:05:58:53 +0000] "GET /backend/actuator/env HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:05:58:53 +0000] "GET /api/actuator/logfile HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:05:58:53 +0000] "GET /actuator/env HTTP/1.1"
[REDACTED] 200 2627 34.104.203.176 - - [08/Jun/2026:05:58:53 +0000] "GET /server/actuator/heapdump HTTP/1.1"
show less
Port Scan
πΊπΈ
TPI-Abuse
2026-06-08 04:56:40
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (176.203.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (176.203.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 00:56:32.372754 2026] [security2:error] [pid 12711:tid 12711] [client 34.104.203.176:44954] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.hppagewideflorida.com.computersraleigh.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hppagewideflorida.com.computersraleigh.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiZLgGJacdaNLhNWpREM0AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π¨π¦
alexbfr
2026-06-08 02:02:46
(4 days ago)
Fail2Ban Report, nginx-bot-trap jail: Automated honeypot detection.
Port Scan
πΊπΈ
TPI-Abuse
2026-06-08 01:25:37
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (176.203.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.104.203.176 (176.203.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 21:25:34.239165 2026] [security2:error] [pid 25226:tid 25226] [client 34.104.203.176:49272] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kirbysheetmetalworks.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kirbysheetmetalworks.com"] [uri "/dump.sql"] [unique_id "aiYaDv2vUzdO7F5mRaPhowAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack