🇺🇸
TPI-Abuse
2026-10-11 05:29:36
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 01:29:28.807917 2026] [security2:error] [pid 29701:tid 29701] [client 34.118.128.120:49712] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ameliaschaaf.lawyer"] [uri "/%2e%2e/.env"] [unique_id "asseuPFmX-J2-8pIsPunFQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-11 03:14:29
(2 days ago)
Aggressive web scan
Web App Attack
🇩🇪
updown.io
2026-10-11 02:05:47
(2 days ago)
{"level":"info","ts":1791684344.866118,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1791684344.866118,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.118.128.120","remote_port":"56720","client_ip":"34.118.128.120","proto":"HTTP/2.0","method":"GET","host":"auth-status.narrator.ai","uri":"/@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"auth-status.narrator.ai","ech":false}},"bytes_read":0,"user_id":"","duration":0.000175836,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","
...
show less
DDoS Attack
Web App Attack
🇳🇱
Alt255
2026-10-10 23:13:13
(2 days ago)
[ti-17al] Web exploit scanning: 4 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-17al] Web exploit scanning: 4 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.118.128.120 - - [11/Oct/2026:01:13:08 +0200] "GET /.aws/config HTTP/2.0" 404 2004 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
34.118.128.120 - - [11/Oct/2026:01:13:08 +0200] "GET /.aws/credentials HTTP/2.0" 404 2004 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.118.128.120 - - [11/Oct/2026:01:13:08 +0200] "GET /.git/config HTTP/2.0" 404 2004 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.118.128.120 - - [11/Oct/2026:01:13:08 +0200] "GET /core/.env HTTP/2.0" 404 2004 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/
...
show less
Bad Web Bot
Web App Attack
🇪🇸
pipeline.es
2026-10-10 23:06:28
(2 days ago)
Web scanning / probing for vulnerable paths | URL: /temp/.env | Evidence: www.ysiviajas.es 34.118.12 ...
show more
Web scanning / probing for vulnerable paths | URL: /temp/.env | Evidence: www.ysiviajas.es 34.118.128.120 - - [11/Oct/2026:01:06:05 +0200] \"GET /temp/.env HTTP/1.1\" 404 10458 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)\" GEOIP_COUNTRY_CODE=CA | ASN: GOOGLE-CLOUD-PLATFORM | Country: CA
show less
Port Scan
Web App Attack
🇺🇸
daveoctober
2026-10-10 20:35:38
(2 days ago)
October Sentinel: honeypot triggered
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 20:06:37
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 16:06:33.878535 2026] [security2:error] [pid 14994:tid 14994] [client 34.118.128.120:56410] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "madisonmedia.ai"] [uri "/docker/.env"] [unique_id "asqayYZ9f3k2OCwyteMuHwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 19:48:21
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 15:48:17.416130 2026] [security2:error] [pid 22660:tid 22660] [client 34.118.128.120:33860] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kritaka.ai"] [uri "/userfiles"] [unique_id "asqWgfODRqWyS0fbQ1CGZAAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
Valhalla
2026-10-10 19:32:38
(2 days ago)
/webpack-stats.json
Hacking
Web App Attack
🇬🇧
consul.to
2026-10-10 18:25:29
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 17:40:07
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:40:00.455555 2026] [security2:error] [pid 2672:tid 2672] [client 34.118.128.120:34520] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||chatari.ai|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chatari.ai"] [uri "/rclone.conf"] [unique_id "asp4cEWDTjTjhVjgfVZFPQAAAIs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-10 17:20:08
(2 days ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-10-10 17:09:25
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:949110) triggered by 34.118.128.120 (120.128.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:09:20.241817 2026] [security2:error] [pid 1438:tid 1438] [client 34.118.128.120:51848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "auranet.ai"] [uri "/admin/.env"] [unique_id "aspxQPgPqpYU73htlj6BJQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
v1nc
2026-10-10 16:47:52
(2 days ago)
34.118.128.120 - - [10/Oct/2026:16:47:52 +0000] "GET /account/login HTTP/1.1" 404 181 "-" "Mozilla/5 ...
show more
34.118.128.120 - - [10/Oct/2026:16:47:52 +0000] "GET /account/login HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
...
show less
Hacking
