🇺🇸
TPI-Abuse
2026-10-15 23:28:27
(21 minutes ago)
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 19:28:20.614895 2026] [security2:error] [pid 3362:tid 3362] [client 34.107.34.79:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.ralphrichardson.com|F|2"] [data ".ralphrichardson.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.ralphrichardson.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.ralphrichardson.com"] [unique_id "atFhlMvqX7sJORWtNeb6WQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 22:37:39
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 18:37:32.043143 2026] [security2:error] [pid 28688:tid 28688] [client 34.107.34.79:48650] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.printedweddingribbon.com"] [uri "/web/.env"] [unique_id "atFVrFYDR2HRdO30Xas4lwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
solantex
2026-10-15 19:36:03
(4 hours ago)
Unauthorized automated scanning and reconnaissance against Solantex resources. No crawl, scan or tes ...
show more
Unauthorized automated scanning and reconnaissance against Solantex resources. No crawl, scan or test permission has been granted to this source.
show less
Web App Attack
🇩🇪
updown.io
2026-10-15 19:14:58
(4 hours ago)
{"level":"info","ts":1792091698.056369,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1792091698.056369,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.107.34.79","remote_port":"60350","client_ip":"34.107.34.79","proto":"HTTP/2.0","method":"GET","host":"status.plushost.gr","uri":"/","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Ch-Ua-Mobile":["?1"],"Sec-Fetch-Dest":["document"],"Sec-Ch-Ua-Platform":["\"Android\""],"Sec-Fetch-Mode":["navigate"],"Priority":["u=0, i"],"Accept-Language":["en-US,en;q=0.9"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Upgrade-Insecure-Requests":["1"],"X-Nextjs-Data":["1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"],"Sec-Fetch-User":[
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 18:53:34
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 14:53:29.470224 2026] [security2:error] [pid 19749:tid 19749] [client 34.107.34.79:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pulleasy.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pulleasy.com"] [uri "/z9x8c7v6b5-debug-trigger-pulleasy.com"] [unique_id "atEhKSrMttFReyn5mINj1QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-10-15 18:37:48
(5 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, path_traversal, aws_creds, git_exposure, credential_file, ssh_keys, source_backup, dotfile_probe. Observed by 1 sensor(s); 400 hits.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 18:01:12
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 14:01:07.940428 2026] [security2:error] [pid 24199:tid 24199] [client 34.107.34.79:53282] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.pattifox.com|F|2"] [data ".pattifox.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.pattifox.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.pattifox.com"] [unique_id "atEU48vSScTU86To9eWjJwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-15 17:39:38
(6 hours ago)
[ti-07al] Web exploit scanning: 71 suspicious requests detected by fail2ban jail apache-scanner. Exa ...
show more
[ti-07al] Web exploit scanning: 71 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.107.34.79 - - [15/Oct/2026:19:39:18 +0200] "GET /core/.env HTTP/1.1" 302 403 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 15:46:10
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:46:02.893893 2026] [security2:error] [pid 10525:tid 10525] [client 34.107.34.79:34532] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.randykincaid.com|F|2"] [data ".randykincaid.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.randykincaid.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.randykincaid.com"] [unique_id "atD1Ot4lQMyQbNQ62x0YXwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
gtheo99
2026-10-15 12:04:24
(11 hours ago)
(CT) IP 34.107.34.79 (DE/Germany/79.34.107.34.bc.googleusercontent.com) found to have 134 connection ...
show more
(CT) IP 34.107.34.79 (DE/Germany/79.34.107.34.bc.googleusercontent.com) found to have 134 connections
show less
Port Scan
🇲🇾
Rizzy
2026-10-15 11:29:53
(12 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 11:26:21
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.107.34.79 (79.34.107.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:26:16.511088 2026] [security2:error] [pid 30792:tid 30792] [client 34.107.34.79:60260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.periodthreads.com"] [uri "/.htpasswd"] [unique_id "atC4WBO-Dttp2q_sqizcwQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
rubixstudios
2026-10-15 10:27:02
(13 hours ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
2026-10-15 10:15:03
(13 hours ago)
suspicious request in access.log
Web App Attack
2026-10-15 10:14:38
(13 hours ago)
Aggressive web scan
Web App Attack
