🇳🇱
Site.eu
2026-09-23 04:50:37
(4 hours ago)
Excessive multi-domain requests
Brute-Force
🇿🇦
conure.sh
2026-09-22 01:30:05
(1 day ago)
csagent: score 20.5: wp-config backup grab x2, 404 noise floor x2; 1 domain(s) in 1s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 01:29:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:29:12.070201 2026] [security2:error] [pid 3724:tid 3724] [client 34.156.49.217:41500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.belgiophar.net"] [uri "/api/.env"] [unique_id "arHZ6E8Vi5LPcpgpliGxxAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇺
SiteXL
2026-09-22 01:04:58
(1 day ago)
Automated Fail2Ban detection: malicious activity observed; source IP was banned.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 01:01:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:01:15.955007 2026] [security2:error] [pid 15697:tid 15697] [client 34.156.49.217:43282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.photospecialties.net"] [uri "/@fs/app/.env"] [unique_id "arHTW7acdTrsByw7m2hz6QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-22 00:17:59
(1 day ago)
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.156.49.217 - - [22/Sep/2026:02:17:38 +0200] "GET /.gitconfig HTTP/2.0" 401 532 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 23:25:40
(1 day ago)
(mod_security) mod_security (id:210580) triggered by 34.156.49.217 (217.49.156.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210580) triggered by 34.156.49.217 (217.49.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:25:36.653261 2026] [security2:error] [pid 1119:tid 1119] [client 34.156.49.217:39660] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||studioarts.net|F|2"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "studioarts.net"] [uri "/userfiles"] [unique_id "arG88NUjKp9vu-uon_60YwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-09-21 21:32:31
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.156.49.217 (BE/Be ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.156.49.217 (BE/Belgium/217.49.156.34.bc.googleusercontent.com)
show less
Bad Web Bot
🇳🇱
oisecnet
2026-09-21 21:02:23
(1 day ago)
Automated report: Unauthorized vulnerability scanning detected on 2026-09-21. 507 requests from this ...
show more
Automated report: Unauthorized vulnerability scanning detected on 2026-09-21. 507 requests from this IP.
show less
Port Scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 19:21:51
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 15:21:45.985832 2026] [security2:error] [pid 18424:tid 18424] [client 34.156.49.217:38222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.scperu.net"] [uri "/web/.env"] [unique_id "arGDyWUdtQHF1Q9bi2zbBwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 18:07:59
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.156.49.217 (217.49.156.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.156.49.217 (217.49.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 14:07:54.831314 2026] [security2:error] [pid 8650:tid 8650] [client 34.156.49.217:39072] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.yeejia.net|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.yeejia.net"] [uri "/trace.axd"] [unique_id "arFyekDNpvacVlC37FwQFgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
webgobe
2026-09-21 17:11:10
(1 day ago)
lee-17 : Block hidden directories=>/.env.js(/)
Hacking
🇮🇳
Yogesh Don
2026-09-21 17:06:00
(1 day ago)
DNS Compromise
Brute-Force
Web App Attack
SQL Injection
2026-09-21 15:19:20
(1 day ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 15:15:22
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.49.217 (217.49.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 11:15:15.602017 2026] [security2:error] [pid 5502:tid 5502] [client 34.156.49.217:41072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.houseofbates.net"] [uri "/.env.local"] [unique_id "arFKAwdwlR8sT9UFhFBvXgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack