🇨🇭
4server
2026-10-05 20:10:30
(2 weeks ago)
[MonOct0522:10:27.7431242026][security2:error][pid1102661:tid1102684][client34.19.149.195:0]ModSecur ...
show more
[MonOct0522:10:27.7431242026][security2:error][pid1102661:tid1102684][client34.19.149.195:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"cpanel.4-server.com\"][uri\"/userfiles\"][unique_id\"asQEM4snnlFACzlsqh9RnwAAANU\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 20:10:00
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.19.149.195 (195.149.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.149.195 (195.149.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 16:09:56.562869 2026] [security2:error] [pid 32367:tid 32367] [client 34.19.149.195:51884] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.13waggoners.com"] [uri "/static//.env"] [unique_id "asQEFKcSgpqA7PtqIUr0lAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Philister11
2026-10-05 01:55:40
(2 weeks ago)
CrowdSec: crowdsecurity/http-bad-user-agent (CA/AS396982)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 01:44:08
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 21:44:04.319811 2026] [security2:error] [pid 3298:tid 3298] [client 34.19.149.195:46144] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||4lazytrafficschool.4lazy.com|F|2"] [data ".4lazy.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "4lazytrafficschool.4lazy.com"] [uri "/z9x8c7v6b5-debug-trigger-4lazytrafficschool.4lazy.com"] [unique_id "asMA5HEMknLDrw12DgT1HQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 01:05:32
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 21:05:24.848476 2026] [security2:error] [pid 29411:tid 29411] [client 34.19.149.195:37330] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wolter-hausser.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wolter-hausser.com"] [uri "/z9x8c7v6b5-debug-trigger-wolter-hausser.com"] [unique_id "asL31F8UW4Hg1pCDsW00SwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
pm33
2026-10-05 01:03:58
(2 weeks ago)
Excessive crawling HTTP 404
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-05 00:53:01
(2 weeks ago)
(mod_security) mod_security (id:949110) triggered by 34.19.149.195 (CA/Canada/195.149.19.34.bc.googl ...
show more
(mod_security) mod_security (id:949110) triggered by 34.19.149.195 (CA/Canada/195.149.19.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇩🇪
paissangroup
2026-10-05 00:41:03
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
Mundo Bueno
2026-10-05 00:27:07
(2 weeks ago)
[ISILIA Protection v2.3] Tentative d'accès: /uploads../.env [RATE LIMITED - 1800s quarantine] | Pays ...
show more
[ISILIA Protection v2.3] Tentative d'accès: /uploads../.env [RATE LIMITED - 1800s quarantine] | Pays: CA | UA: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 00:11:44
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 20:11:38.209231 2026] [security2:error] [pid 8650:tid 8650] [client 34.19.149.195:56536] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||iyp-home.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "iyp-home.com"] [uri "/z9x8c7v6b5-debug-trigger-iyp-home.com"] [unique_id "asLrOk4EmotSLjwv7JR79gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 23:54:34
(2 weeks ago)
(mod_security) mod_security (id:210580) triggered by 34.19.149.195 (195.149.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210580) triggered by 34.19.149.195 (195.149.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 19:54:29.416498 2026] [security2:error] [pid 23058:tid 23058] [client 34.19.149.195:0] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||gibitdigital.com|F|2"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "gibitdigital.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "asLnNaGGl0QpSmKoAPeKUAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-04 23:48:04
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 23:37:33
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.19.149.195 (195.149.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 19:37:26.869845 2026] [security2:error] [pid 27574:tid 27574] [client 34.19.149.195:37414] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||callalbany.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "callalbany.com"] [uri "/z9x8c7v6b5-debug-trigger-callalbany.com"] [unique_id "asLjNv-riuzPgjZ-X2bqJwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-04 20:25:02
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-04 19:39:27
(2 weeks ago)
[cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.19.149.195 - - [04/Oct/2026:21:39:12 +0200] "GET /images../.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
...
show less
Bad Web Bot
Web App Attack
