🇺🇸
mnsf
2026-09-22 09:05:14
UTC ·
(1 month ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 05:53:42
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.121.161.215 (215.161.121.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 01:53:35.687279 2026] [security2:error] [pid 25444:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.121.161.215 (215.161.121.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 01:53:35.687279 2026] [security2:error] [pid 25444:tid 25444] [client 34.121.161.215:46522] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.universtech.softwarezz.net|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.universtech.softwarezz.net"] [uri "/.codex/auth.json.bak"] [unique_id "arIX3-FfzgB8NPZCGmd2fAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
LSPCCU
2026-09-22 04:42:17
UTC ·
(1 month ago)
TSEC Honeypot Network report. Threat score: 63/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: 34.121.161.215 classified as botnet node participating in coordinated attack campaigns (high confidenc ...
show more
TSEC Honeypot Network report. Threat score: 63/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: 34.121.161.215 classified as botnet node participating in coordinated attack campaigns (high confidence).
show less
Port Scan
Hacking
Brute-Force
Web App Attack
SSH
🇺🇸
TPI-Abuse
2026-09-22 01:24:50
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.121.161.215 (215.161.121.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:24:43.437313 2026] [security2:error] [pid 27285:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.121.161.215 (215.161.121.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:24:43.437313 2026] [security2:error] [pid 27285:tid 27285] [client 34.121.161.215:45964] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||elessenux.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elessenux.com"] [uri "/.codex/auth.json.bak"] [unique_id "arHY2_nmAlqidkasJ1KC5wAAAF8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-22 01:13:44
UTC ·
(1 month ago)
[TueSep2203:13:42.3074902026][security2:error][pid46507:tid46642][client34.121.161.215:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess ...
show more
[TueSep2203:13:42.3074902026][security2:error][pid46507:tid46642][client34.121.161.215:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.creazione-siti-web-ticino.hosting-royal.ch\"][uri\"/.codex/auth.json.old\"][unique_id\"arHWRoqFhSol5-Ijwu1xsQAAARY\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-09-22 00:35:39
UTC ·
(1 month ago)
excessive HTTP 404 errors
Bad Web Bot
🇺🇸
brightenfield
2026-09-21 13:11:32
UTC ·
(1 month ago)
Web App Attack
Web App Attack
2026-09-21 12:18:57
UTC ·
(1 month ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
2026-09-21 11:57:56
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇳🇱
Savvii
2026-09-21 11:54:28
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-21 11:49:23
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
mnsf
2026-09-21 08:05:40
UTC ·
(1 month ago)
Abuse Detected (2)
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-09-21 04:20:07
UTC ·
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-21 04:15:11
UTC ·
(1 month ago)
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /old/.codex/auth.json HTTP/1.1" 404 46273 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /www/.claude/credentials.json HTTP/1.1" 404 46272 "-" "crusader-worker/1.0"
...
show more
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /old/.codex/auth.json HTTP/1.1" 404 46273 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /www/.claude/credentials.json HTTP/1.1" 404 46272 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /bak/.codex/auth.json HTTP/1.1" 404 46271 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 46124 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /data/.codex/auth.json HTTP/1.1" 404 46272 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /old/.claude/credentials.json HTTP/1.1" 404 46273 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /var/www/.codex/auth.json HTTP/1.1" 404 46273 "-" "crusader-worker/1.0"
34.121.161.215 - - [21/Sep/2026:06:15:07 +0200] "GET /.codex/config.toml HTTP/1.1" 404 46271 "-" "crusader-worker/1.0"
34.121.161.21
show less
Bad Web Bot
