🇬🇧
consul.to
2026-09-30 04:32:36
(16 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
netclix.gr
2026-09-30 03:57:28
(16 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.185.242.17 (DE/Germany/17.242.185.34 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.185.242.17 (DE/Germany/17.242.185.34.bc.googleusercontent.com): (CF_ENABLE)
show less
SQL Injection
🇩🇪
FD-IX
2026-09-30 03:11:04
(17 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:51:41
(19 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.185.242.17 (17.242.185.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.185.242.17 (17.242.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:51:37.991270 2026] [security2:error] [pid 8606:tid 8606] [client 34.185.242.17:34576] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||robertmcatee.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "robertmcatee.com"] [uri "/z9x8c7v6b5-debug-trigger-robertmcatee.com"] [unique_id "arxrKZSL-pbruj7SjKLu7gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-30 01:32:27
(19 hours ago)
167 requests with url.path */proc/*
134 requests with url.path *.php.bak
Brute-Force
Bad Web Bot
🇨🇭
YF
2026-09-30 01:30:34
(19 hours ago)
Distributed subnet attack — coordinated scanning from multiple IPs in the same /24
DDoS Attack
Web App Attack
2026-09-30 01:20:03
(19 hours ago)
suspicious request in access.log
Web App Attack
🇺🇸
abuse-opdc
2026-09-30 00:46:04
(20 hours ago)
Malicious HTTP requests matching injection/exploit signatures.
Web App Attack
Brute-Force
🇫🇷
ELYAZ
2026-09-30 00:44:04
(20 hours ago)
(y3) Failed access -byebye- from 34.185.242.17 (DE/Germany/17.242.185.34.bc.googleusercontent.com): ...
show more
(y3) Failed access -byebye- from 34.185.242.17 (DE/Germany/17.242.185.34.bc.googleusercontent.com): (CF_ENABLE)
show less
Hacking
🇳🇱
Savvii
2026-09-29 23:53:32
(21 hours ago)
26 attempts against mh-misbehave-ban on glow
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 23:39:18
(21 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.185.242.17 (17.242.185.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.185.242.17 (17.242.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:39:14.720917 2026] [security2:error] [pid 9448:tid 9448] [client 34.185.242.17:52672] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||zackfranz.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "zackfranz.com"] [uri "/z9x8c7v6b5-debug-trigger-zackfranz.com"] [unique_id "arxMIqWbh6BnjkXpy6YFmgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-29 23:12:29
(21 hours ago)
34.185.242.17 - - [30/Sep/2026:01:12:28 +0200] "GET / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Windows NT ...
show more
34.185.242.17 - - [30/Sep/2026:01:12:28 +0200] "GET / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.185.242.17 - - [30/Sep/2026:01:12:28 +0200] "GET /signup HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.185.242.17 - - [30/Sep/2026:01:12:28 +0200] "GET /lmbx5r45q9ngx4teuo3j HTTP/1.1" 403 124 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
34.185.242.17 - - [30/Sep/2026:01:12:29 +0200] "GET /user/login HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.185.242.17 - - [30/Sep/2026:01:12:29 +0200] "GET /auth HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.185.242.17 - - [30/Sep/2026:01:12:29 +0200] "POST / HT
...
show less
Bad Web Bot
Web App Attack
2026-09-29 23:07:32
(21 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-09-29 23:03:20
(21 hours ago)
88 attempts against mh-misbehave-ban on glow
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 23:00:17
(21 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.185.242.17 (17.242.185.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.185.242.17 (17.242.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:00:13.136856 2026] [security2:error] [pid 24001:tid 24001] [client 34.185.242.17:34662] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||zacharypowers.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "zacharypowers.com"] [uri "/z9x8c7v6b5-debug-trigger-zacharypowers.com"] [unique_id "arxC_RzCoDApdX5t-TNpXwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack