🇺🇸
TPI-Abuse
2026-10-17 04:04:53
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 00:04:48.439187 2026] [security2:error] [pid 24351:tid 24351] [client 34.154.120.11:51578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.darkcodedesign.net"] [uri "/.git/config"] [unique_id "atLz4N2qiqMxBw8cTE5LUAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-16 23:40:52
(2 days ago)
[SatOct1701:40:46.7112082026][security2:error][pid1814152:tid1814312][client34.154.120.11:0]ModSecur ...
show more
[SatOct1701:40:46.7112082026][security2:error][pid1814152:tid1814312][client34.154.120.11:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"autodiscover.creazione-siti-web-ticino.ch\"][uri\"/\"][unique_id\"atK1_p1_2cRY3Vi9olsICQAAAVM
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 21:24:10
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:24:02.401289 2026] [security2:error] [pid 21745:tid 21768] [client 34.154.120.11:42716] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cookmanufacturinggroup.com"] [uri "/.git/config"] [unique_id "atKV8nXOY2fEyTrBZJNv4gAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
rubixstudios
2026-10-16 21:22:02
(2 days ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-10-16 21:10:44
(2 days ago)
[Fri Oct 16 15:10:42.138013 2026] [authz_core:error] [pid 141741:tid 139746667906624] [client 34.154 ...
show more
[Fri Oct 16 15:10:42.138013 2026] [authz_core:error] [pid 141741:tid 139746667906624] [client 34.154.120.11:44912] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Fri Oct 16 15:10:44.100769 2026] [authz_core:error] [pid 141741:tid 139745074046528] [client 34.154.120.11:44912] AH01630: client denied by server configuration: /var/www/horde/.env.dist
[Fri Oct 16 15:10:44.214832 2026] [authz_core:error] [pid 141741:tid 139745006904896] [client 34.154.120.11:44912] AH01630: client denied by server configuration: /var/www/horde/.env.swp
...
show less
Bad Web Bot
🇫🇷
Catalin Negru
2026-10-16 19:20:24
(2 days ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇺🇸
TPI-Abuse
2026-10-16 17:21:50
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 13:21:44.405003 2026] [security2:error] [pid 15403:tid 15403] [client 34.154.120.11:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cloudex.click"] [uri "/.git/config"] [unique_id "atJdKBiqCzg4eO9-bX_FgAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-10-16 16:19:00
(2 days ago)
34.154.120.11 - - [16/Oct/2026:19:18:59 +0300] "GET /.git/config HTTP/1.1" 400 63 "-" "Mozilla/5.0 ( ...
show more
34.154.120.11 - - [16/Oct/2026:19:18:59 +0300] "GET /.git/config HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.154.120.11 - - [16/Oct/2026:19:18:59 +0300] "GET /.env.local HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 15:36:01
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 11:35:53.249271 2026] [security2:error] [pid 32009:tid 32009] [client 34.154.120.11:37476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cityviewsportsbar.com"] [uri "/.git/config"] [unique_id "atJEWU_6gQWBjFZSHzI8kwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
phoenix1jl96
2026-10-16 12:47:45
(3 days ago)
2026/10/16 14:47:44 [error] 5458#5458: *23658 open() "/home/user-data/www/default/mailer/.env" faile ...
show more
2026/10/16 14:47:44 [error] 5458#5458: *23658 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.154.120.11, server: autodiscover.chat.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "autodiscover.chat.ledemon.us"
2026/10/16 14:47:44 [error] 5458#5458: *23658 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 34.154.120.11, server: autodiscover.chat.ledemon.us, request: "GET /mail/.env HTTP/1.1", host: "autodiscover.chat.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇩🇪
Dominik Lysiak
2026-10-16 06:31:33
(3 days ago)
34.154.120.11 - - [16/Oct/2026:08:31:33 +0200] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 ...
show more
34.154.120.11 - - [16/Oct/2026:08:31:33 +0200] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.154.120.11 - - [16/Oct/2026:08:31:33 +0200] "GET /.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.154.120.11 - - [16/Oct/2026:08:31:33 +0200] "GET /.env.local HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 04:02:54
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 00:02:50.002733 2026] [security2:error] [pid 32573:tid 32573] [client 34.154.120.11:56768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.buyhealthy.net"] [uri "/.git/config"] [unique_id "atGh6kxokIhsVPbHyIOEGAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 00:56:40
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.120.11 (11.120.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 20:56:34.794914 2026] [security2:error] [pid 15417:tid 15417] [client 34.154.120.11:48700] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.brewcitybros.com"] [uri "/.git/config"] [unique_id "atF2QoXE8ottyoH9RtUNAAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-15 23:05:04
(3 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
Petros Stefanakis
2026-10-15 18:21:00
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.154.120.11 (IT/Italy/11.120.154.34.b ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.154.120.11 (IT/Italy/11.120.154.34.bc.googleusercontent.com)
show less
SQL Injection
