🇧🇷
ICS Labs
2026-11-05 13:23:05
UTC ·
(5 days ago)
ICS Labs threat intelligence (ICS Feeds): Port Scan, Brute-Force. Last observed 2026-11-05 UTC.
Port Scan
Brute-Force
🇳🇱
e.fierstra
2026-11-05 11:20:41
UTC ·
(5 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 10:03:33
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 05:03:25.513774 2026] [security2:error] [pid 12529:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 05:03:25.513774 2026] [security2:error] [pid 12529:tid 12529] [client 34.104.215.205:59410] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.srosa.com|F|2"] [data ".srosa.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.srosa.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.srosa.com"] [unique_id "auxUbSkdxRqVG9ROA0onTAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-05 09:18:16
UTC ·
(5 days ago)
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.staging.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 34.104.215.205
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.supaba ...
show more
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.staging.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 34.104.215.205
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.supabase HTTP/1.1" 429 227 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.104.215.205
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.production.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)" 34.104.215.205
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.testing HTTP/1.1" 429 227 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36" 34.104.215.205
34.104.215.205 - - [05/Nov/2026:03:18:15 -0600] "GET /.env.dev.local HTTP/1.1" 429 227 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.104.215.205
34.104.215.205 - - [05/Nov/20
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-11-05 06:58:55
UTC ·
(5 days ago)
Blocked by CSF 13 firewall - Rule: config-dotfile
US/United States/205.215.104.34.bc.googleusercontent.com
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:01:00
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:00:53.055636 2026] [security2:error] [pid 22892:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:00:53.055636 2026] [security2:error] [pid 22892:tid 22892] [client 34.104.215.205:45676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.siczewicz.com"] [uri "/api/fs/read"] [unique_id "auwblacBzDVig6aOmv5OygAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 05:20:23
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:20:19.872245 2026] [security2:error] [pid 20706:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:20:19.872245 2026] [security2:error] [pid 20706:tid 20706] [client 34.104.215.205:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.socialstudiesforkids.com"] [uri "/.env.supabase"] [unique_id "auwSE5pcnTRgc9O_P3LidAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 01:59:49
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 20:59:44.382779 2026] [security2:error] [pid 12159:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.104.215.205 (205.215.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 20:59:44.382779 2026] [security2:error] [pid 12159:tid 12159] [client 34.104.215.205:45774] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.shannonmatter.com|F|2"] [data ".shannonmatter.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.shannonmatter.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.shannonmatter.com"] [unique_id "auvjEFr56XssTP4BOt2BIAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-05 00:04:45
UTC ·
(5 days ago)
Multiple WAF Violations
Web App Attack
🇿🇦
hostsec_za
2026-11-04 23:45:08
UTC ·
(5 days ago)
cPanel/Webmail Auth Attack. 355 failed logins in 6 hours.
Brute-Force
🇿🇦
Megasurf
2026-11-04 23:07:55
UTC ·
(5 days ago)
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
Web App Attack
🇮🇩
Burayot
2026-11-04 23:01:43
UTC ·
(5 days ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 34.104.215.205 (JP/Japan/205.215.104.34.bc.googleusercontent.com): 2 in the last 3600 secs
Web App Attack
🇳🇱
Site.eu
2026-11-04 21:34:01
UTC ·
(6 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-11-04 20:59:26
UTC ·
(6 days ago)
Inbound Anomaly Score Exceeded (Total Score: 5). Operator GE matched 5 at TX:anomaly_score. (949110-122)
Hacking
🇷🇴
clauss
2026-11-04 20:36:51
UTC ·
(6 days ago)
34.104.215.205 - - [04/Nov/2026:22:36:50 +0200] "GET /rclone.conf HTTP/2.0" 403 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/app ...
show more
34.104.215.205 - - [04/Nov/2026:22:36:50 +0200] "GET /rclone.conf HTTP/2.0" 403 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
34.104.215.205 - - [04/Nov/2026:22:36:50 +0200] "GET /laravel../config/database.php HTTP/2.0" 404 34539 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
...
show less
Web App Attack
