🇳🇱
homeshowdomain.nl
2026-06-08 22:01:57
(2 weeks ago)
Auto-ban: >3000 req/min op 2026-06-08
Web App Attack
SSH
Hacking
🇵🇱
dcnet
2026-06-08 22:00:15
(2 weeks ago)
FortiGate detected DOS attack from IPv4 address 34.159.127.177
DDoS Attack
🇨🇦
Mediashaker
2026-06-08 16:45:16
(2 weeks ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 34.159.127.177 (DE/Germa ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 34.159.127.177 (DE/Germany/177.127.159.34.bc.googleusercontent.com)
show less
Port Scan
🇩🇪
FeG Deutschland
2026-06-08 15:26:56
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 14:52:28
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 10:52:22.119802 2026] [security2:error] [pid 5589:tid 5589] [client 34.159.127.177:40290] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||teachingthestars.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "teachingthestars.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aibXJsrSjxVtS0nuw-SnhQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 14:19:03
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 10:18:59.372247 2026] [security2:error] [pid 5902:tid 5902] [client 34.159.127.177:52626] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hazardrecords.org.ankitoner.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hazardrecords.org.ankitoner.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aibPU1IohBTsq29PBPHgjQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-08 13:36:27
(2 weeks ago)
34.159.127.177 - - [08/Jun/2026:15:36:24 +0200] "GET /actuator/threaddump HTTP/1.1" 403 7932 "-" "Mo ...
show more
34.159.127.177 - - [08/Jun/2026:15:36:24 +0200] "GET /actuator/threaddump HTTP/1.1" 403 7932 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
34.159.127.177 - - [08/Jun/2026:15:36:24 +0200] "GET /actuator/sessions HTTP/1.1" 403 7932 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.113 Safari/537.36 Vivaldi/2.1.1337.51"
34.159.127.177 - - [08/Jun/2026:15:36:24 +0200] "GET /actuator/auditevents HTTP/1.1" 403 7932 "-" "Mozilla/5.0 (Linux; Android 9; VTR-L09) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
34.159.127.177 - - [08/Jun/2026:15:36:24 +0200] "GET /actuator/logfile HTTP/1.1" 403 7932 "-" "Mozilla/5.0 (Linux; Android 9; MI 8 Build/PKQ1.180729.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/67.0.3396.87 XWEB/882 MMWEBSDK/190506 Mobile Safari/537.36 MMWEBID/409 MicroMessenger/7.0.6.1460(0x27000634) Process/to
...
show less
DDoS Attack
🇫🇮
YF
2026-06-08 13:00:20
(2 weeks ago)
Attaque distribuée subnet
DDoS Attack
Web App Attack
2026-06-08 12:33:55
(2 weeks ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 12:01:34
(2 weeks ago)
(mod_security) mod_security (id:210831) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210831) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 08:01:28.282552 2026] [security2:error] [pid 14857:tid 14857] [client 34.159.127.177:42074] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||mail.betnbet.ag|F|4"] [data "grub-client"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "mail.betnbet.ag"] [uri "/api/actuator/configprops"] [unique_id "aiavGBuKRcLjfEO02PUACwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-08 10:22:34
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
updown.io
2026-06-08 06:46:03
(2 weeks ago)
{"level":"info","ts":1780901154.6703508,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1780901154.6703508,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.127.177","remote_port":"60366","client_ip":"34.159.127.177","proto":"HTTP/1.1","method":"GET","host":"vutsrqupdate.ilkjihgbwwwc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/v2/actuator/configprops","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.000096033,"size":0,"status":308,"resp_headers":{"Location":["https://vutsrqupdate.ilkjihgbwwwc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/v2/actuator/configprops"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}}
{"level":"info","ts":1780901154.9813707,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.127.177
...
show less
DDoS Attack
Web App Attack
🇳🇱
wlt-blocker
2026-06-08 05:23:10
(2 weeks ago)
Unauthorized access to webpage admin
Web App Attack
🇳🇱
Site.eu
2026-06-08 05:03:05
(2 weeks ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
TPI-Abuse
2026-06-08 04:18:37
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.127.177 (177.127.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 00:18:30.371468 2026] [security2:error] [pid 14364:tid 14364] [client 34.159.127.177:48022] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||paxbrewing.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paxbrewing.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiZCll_bEVqfKEmbEcSu8QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack