🇺🇸
TPI-Abuse
2026-10-02 15:02:21
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 11:02:14.980186 2026] [security2:error] [pid 17034:tid 17034] [client 34.12.62.124:49668] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.97films.media"] [uri "/public../.env"] [unique_id "ar_HdjKNh57IW0Fu2HIjQwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-02 14:33:03
(2 weeks ago)
Repeated requests for suspicious nonexistent URLs, for example: /graphql (HTTP/1.1 port 443, user ag ...
show more
Repeated requests for suspicious nonexistent URLs, for example: /graphql (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36")
show less
Web App Attack
🇳🇱
Site.eu
2026-10-02 14:10:09
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
2026-10-02 13:37:59
(2 weeks ago)
Web probing (474 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by ...
show more
Web probing (474 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON.
show less
Web App Attack
🇩🇪
updown.io
2026-10-02 11:59:19
(2 weeks ago)
{"level":"info","ts":1790942358.7522395,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1790942358.7522395,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.12.62.124","remote_port":"51550","client_ip":"34.12.62.124","proto":"HTTP/2.0","method":"GET","host":"status.caspit.biz","uri":"/assets/manifest.json","headers":{"Accept":["*/*"],"Sec-Ch-Ua-Platform":["\"Android\""],"Accept-Language":["en-US,en;q=0.9"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"Sec-Ch-Ua-Mobile":["?1"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Mode":["no-cors"],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"],"Sec-Fetch-Dest":["script"],"Sec-Fetch-Site":["same-origin"],"Priority":["u=1"],"Sec-Ch-Ua":["\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\""]},"tls":{
...
show less
DDoS Attack
Web App Attack
🇳🇱
Alt255
2026-10-02 10:59:57
(2 weeks ago)
[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.12.62.124 - - [02/Oct/2026:12:59:40 +0200] "GET /.env.development HTTP/2.0" 301 504 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
...
show less
Bad Web Bot
Web App Attack
🇪🇸
scaballe
2026-10-02 10:44:18
(2 weeks ago)
Web App Attack
🇳🇱
Savvii
2026-10-02 09:56:49
(2 weeks ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
zynex
2026-10-02 09:12:20
(2 weeks ago)
URL Probing: /@fs/.env
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 09:05:32
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:05:27.016759 2026] [security2:error] [pid 3458:tid 3458] [client 34.12.62.124:49126] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||atsllc.biz|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atsllc.biz"] [uri "/rclone.conf"] [unique_id "ar9z18yY2aXsN2d72wJBMAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
Michael McCarthy
2026-10-02 08:55:45
(2 weeks ago)
Web Spam
🇩🇪
LRob
2026-10-02 08:27:56
(2 weeks ago)
Crawler ignoring refusals | ua: Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers ...
show more
Crawler ignoring refusals | ua: Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0, Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/) (+4 more) | path: /6irzl7vxrb5umcwt7w1g, /dist/manifest.json, /dist/.vite/manifest.json (+7 more)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 08:17:12
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 04:17:04.413987 2026] [security2:error] [pid 21267:tid 21267] [client 34.12.62.124:58406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "global.ic1.biz"] [uri "/images../.env"] [unique_id "ar9ogMK3YIcSxNChDDKmugAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-02 07:33:23
(2 weeks ago)
34.12.62.124 detected on srv01
Brute-Force
🇺🇸
TPI-Abuse
2026-10-02 07:24:03
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.12.62.124 (124.62.12.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 03:23:59.448861 2026] [security2:error] [pid 28702:tid 28702] [client 34.12.62.124:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.distro.media"] [uri "/config/.env.php"] [unique_id "ar9cD393r7rq4glliRo7aAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
