🇺🇸
TPI-Abuse
2026-09-28 20:39:46
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 16:39:40.921359 2026] [security2:error] [pid 30762:tid 30777] [client 34.143.156.107:35076] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intro.gryphix.com"] [uri "/.git/config"] [unique_id "arrQjP-fIMg5MZg3TTltjAAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-28 19:47:38
(4 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
dot.mg
2026-09-28 02:22:03
(4 days ago)
Bruteforce
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-27 20:31:45
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 16:31:39.896782 2026] [security2:error] [pid 26191:tid 26191] [client 34.143.156.107:58974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.tinseltownartificials.com"] [uri "/.git/config"] [unique_id "arl9K6Fzd8kv11GCmiArVAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-27 19:45:47
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 15:45:43.304619 2026] [security2:error] [pid 18410:tid 18410] [client 34.143.156.107:39576] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.tinkerlabyrinth.com"] [uri "/.git/config"] [unique_id "arlyZ-9u1bGnDTN7LxtiiAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-26 22:12:18
(5 days ago)
33.293 requests in 1 hour (1mo1w5d)
Brute-Force
Bad Web Bot
2026-09-26 21:28:28
(5 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-26 15:21:48
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 11:21:42.444370 2026] [security2:error] [pid 25053:tid 25053] [client 34.143.156.107:49366] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.pundtlaw.com"] [uri "/.git/config"] [unique_id "arfjBt_3c7FyUfloqcSc6QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 13:11:49
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 09:11:44.465841 2026] [security2:error] [pid 23426:tid 23426] [client 34.143.156.107:58764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "airlinechristmascards.com"] [uri "/.git/config"] [unique_id "arfEkBnhwK-J1pthrAIaxAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-26 07:17:22
(6 days ago)
IP matched detection query many 3xx errors.
Brute-Force
2026-09-26 07:00:24
(6 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇩🇪
4server
2026-09-25 03:47:53
(1 week ago)
[FriSep2505:47:47.3530992026][security2:error][pid356700:tid356740][client34.143.156.107:0]ModSecuri ...
show more
[FriSep2505:47:47.3530992026][security2:error][pid356700:tid356740][client34.143.156.107:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"autoconfig.sisuconsulting.net\"][uri\"/\"][unique_id\"arXu45JrJJGTPTMPfRSNsQAAAVQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
factor1
2026-09-25 01:26:43
(1 week ago)
CrowdSec at saturn Reports Abuse
Web App Attack
🇮🇹
VHosting
2026-09-22 08:50:03
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 23:49:44
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.156.107 (107.156.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:49:35.924982 2026] [security2:error] [pid 16791:tid 16791] [client 34.143.156.107:44640] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arzoma.com"] [uri "/.git/config"] [unique_id "arHCj1MD1QUCRZ8_33p_MgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
