|
🇧🇪
cmbplf
|
|
107 requests with url.path */@fs/*
|
Brute-Force
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:47:11.157398 2026] [security2:error] [pid 16187:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:47:11.157398 2026] [security2:error] [pid 16187:tid 16187] [client 34.148.115.113:55546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sanmarinoresidentagent.com"] [uri "/utils/.env"] [unique_id "arHeH4X751mTN3GUO26TtgAAAEQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:20:14.437091 2026] [security2:error] [pid 23535:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:20:14.437091 2026] [security2:error] [pid 23535:tid 23535] [client 34.148.115.113:47356] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "seashellweddingnapkins.com"] [uri "/.env.production"] [unique_id "arHJvj9Z2R9aajw6KsJMxwAAAC4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
ghostwarriors
|
|
Attempts against non-existent wp-login
|
Brute-Force
Web App Attack
|
|
🇩🇪
yitzhaq
|
|
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /rclone.conf HTTP/2.0" 403 299 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /test.php HTTP/2.0" 403 299 "-" "Mozilla/5. ...
show more
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /rclone.conf HTTP/2.0" 403 299 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /test.php HTTP/2.0" 403 299 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /api/v1/models HTTP/2.0" 307 382 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /admin%2F.env HTTP/2.0" 404 297 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /v1/onboarding/config?token= HTTP/2.0" 307 408 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200] "GET /.env.local?raw HTTP/2.0" 307 386 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
34.148.115.113 - - [22/Sep/2026:01:51:56 +0200]
show less
|
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:29:13.262930 2026] [security2:error] [pid 25355:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:29:13.262930 2026] [security2:error] [pid 25355:tid 25355] [client 34.148.115.113:34716] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||saimedo.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "saimedo.com"] [uri "/z9x8c7v6b5-debug-trigger-saimedo.com"] [unique_id "arG9yUsoWDmCUNjPldWtaAAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇷
dynamix
|
|
Multiple WAF Violations
|
Web App Attack
|
|
🇺🇸
dot.mg
|
|
Bad behaviour
|
Web Spam
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 18:59:53.141088 2026] [security2:error] [pid 27996:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 18:59:53.141088 2026] [security2:error] [pid 27996:tid 27996] [client 34.148.115.113:47662] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.sellitwithsteve.com|F|2"] [data ".sellitwithsteve.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.sellitwithsteve.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.sellitwithsteve.com"] [unique_id "arG26ZxE4jbkV0GG-9np4wAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇳🇱
Alt255
|
|
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.148.115.113 - - [22/Sep/2026:00:52:03 +0200] "GET /.aws/credentials HTTP/1.1" 404 518 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@byteda ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.148.115.113 - - [22/Sep/2026:00:52:03 +0200] "GET /.aws/credentials HTTP/1.1" 404 518 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected]) AppleWebKit/537.36"
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇺🇸
IndigoRidge
|
|
34.148.115.113 - - [21/Sep/2026:18:11:32 -0400] "GET /server/.env HTTP/1.1" 403 5511 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected])"
34.148.115.113 - - [21/Sep/2026:18:11:31 -0400] "GET ...
show more
34.148.115.113 - - [21/Sep/2026:18:11:32 -0400] "GET /server/.env HTTP/1.1" 403 5511 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected])"
34.148.115.113 - - [21/Sep/2026:18:11:31 -0400] "GET /.aws/credentials HTTP/1.1" 301 4858 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
34.148.115.113 - - [21/Sep/2026:18:11:33 -0400] "GET /app/.env HTTP/1.1" 403 5511 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
...
show less
|
Web App Attack
|
|
🇩🇪
updown.io
|
|
{"level":"info","ts":1790023283.2966678,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.148.115.113","remote_port":"42906","client_ip":"34.148.115.113","proto":"HTTP/2.0","method":"POST","host":"status.sendybay.com" ...
show more
{"level":"info","ts":1790023283.2966678,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.148.115.113","remote_port":"42906","client_ip":"34.148.115.113","proto":"HTTP/2.0","method":"POST","host":"status.sendybay.com","uri":"/graphql","headers":{"Sec-Fetch-Dest":["empty"],"Content-Type":["application/json"],"Content-Length":["86"],"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Fetch-Site":["same-origin"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Fetch-Mode":["cors"],"Referer":["https://status.sendybay.com"],"Priority":["u=1, i"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"Origin":["https://status.sendybay.com"],"Sec-Ch-Ua-Mobile":["?0"],"Accept-Encoding":["gzip, deflate, br, zstd"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status
...
show less
|
DDoS Attack
Web App Attack
|
|
Anonymous
|
|
| Multiple common web attacks from same source ip. (multiple servers)
|
Web App Attack
Hacking
SQL Injection
|
|
🇺🇸
dot.mg
|
|
Scan of vulnerable files
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 16:19:44.151628 2026] [security2:error] [pid 6127:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 34.148.115.113 (113.115.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 16:19:44.151628 2026] [security2:error] [pid 6127:tid 6209] [client 34.148.115.113:36508] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.sallykimmel.com|F|2"] [data ".sallykimmel.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.sallykimmel.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.sallykimmel.com"] [unique_id "arGRYJQODXDQ0hmnORxI1gAAAM0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
