🇳🇱
homeshowdomain.nl
2026-10-02 21:59:41
UTC ·
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-01.
Web App Attack
SSH
Hacking
🇩🇪
Grossmann-Gruppe
2026-10-02 06:25:51
UTC ·
(1 month ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-10-02 04:18:10
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 00:18:05.296670 2026] [security2:error] [pid 8439:tid 843 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 00:18:05.296670 2026] [security2:error] [pid 8439:tid 8439] [client 34.146.77.27:52202] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greencornokies.org"] [uri "/static../.env"] [unique_id "ar8wfRc6FIC63uLZHPoykAAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 02:52:18
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 22:52:15.176047 2026] [security2:error] [pid 29845:tid 29 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 22:52:15.176047 2026] [security2:error] [pid 29845:tid 29845] [client 34.146.77.27:36710] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||grayowl.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "grayowl.com"] [uri "/z9x8c7v6b5-debug-trigger-grayowl.com"] [unique_id "ar8cXyiZsIeoQmOUQg_-ywAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 02:23:21
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 22:23:14.164817 2026] [security2:error] [pid 8259:tid 825 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 22:23:14.164817 2026] [security2:error] [pid 8259:tid 8259] [client 34.146.77.27:42730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.grollman.com"] [uri "/.htpasswd"] [unique_id "ar8VknUBJIeMbad5g1dL5gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-10-02 01:03:12
UTC ·
(1 month ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇨🇦
Mediashaker
2026-10-02 00:32:37
UTC ·
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.146.77.27 (JP/Japan/27.77.146.34.bc.googleusercontent.com)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 00:18:08
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 20:18:02.957528 2026] [security2:error] [pid 29635:tid 29 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 20:18:02.957528 2026] [security2:error] [pid 29635:tid 29635] [client 34.146.77.27:56434] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.goldengatecorgis.org"] [uri "/web.config"] [unique_id "ar74Osk62b67dOAt6H261wAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-10-02 00:10:07
UTC ·
(1 month ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 00:02:04
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 20:01:56.146239 2026] [security2:error] [pid 14127:tid 14 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 20:01:56.146239 2026] [security2:error] [pid 14127:tid 14146] [client 34.146.77.27:50786] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||grdsys.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "grdsys.com"] [uri "/z9x8c7v6b5-debug-trigger-grdsys.com"] [unique_id "ar70dKp7aKgJ47BpC5Th6AAAAVE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-01 23:40:05
UTC ·
(1 month ago)
1.076 requests with url.path *.env
639 requests with url.path */@fs/*
130 requests with url.path */proc/*
122 requests with url.path *.php.bak
106 requests with url.path *.aws/*
Brute-Force
Bad Web Bot
🇳🇱
Site.eu
2026-10-01 23:21:44
UTC ·
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇫🇷
masterguru
2026-10-01 20:50:53
UTC ·
(1 month ago)
Restricted File Access Attempt. Matched phrase ".ssh/" at REQUEST_FILENAME. (930130-196)
Hacking
Web App Attack
🇳🇱
Savvii
2026-10-01 19:02:34
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 18:21:49
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 14:21:45.535378 2026] [security2:error] [pid 27559:tid 27 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.77.27 (27.77.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 14:21:45.535378 2026] [security2:error] [pid 27559:tid 27559] [client 34.146.77.27:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.grainavi.com"] [uri "/api/console/api_server"] [unique_id "ar6kuYuatpC2pObuyPZLVQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
