🇺🇸
TPI-Abuse
2026-09-21 04:52:38
(1 day ago)
(mod_security) mod_security (id:210580) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210580) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:52:33.581956 2026] [security2:error] [pid 4345:tid 4345] [client 34.24.144.114:57714] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||studioarts.net|F|2"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "studioarts.net"] [uri "/userfiles"] [unique_id "arC4EcwWTsmZYHt0-uMVOQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
Progetto1
2026-09-21 04:30:06
(1 day ago)
Multiple exploit attempts
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 04:19:56
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:19:47.813979 2026] [security2:error] [pid 26448:tid 26448] [client 34.24.144.114:59500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.rahjx.net"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252froot/.env"] [unique_id "arCwY6skr2xmOXeoYz-_rgAAAF4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-21 04:02:03
(1 day ago)
[PROTECTED PATHS] crawler credentials.ini, aws.ini, aws.yml, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:36:52
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:36:46.557438 2026] [security2:error] [pid 28270:tid 28270] [client 34.24.144.114:36960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.globalpackets.net"] [uri "/@fs/app/.env"] [unique_id "arCmTtI65wyl7OyYajLpbQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:18:04
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:17:57.031459 2026] [security2:error] [pid 28117:tid 28117] [client 34.24.144.114:35780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.billwegener.net"] [uri "/.git/HEAD"] [unique_id "arCh5R-Igm5QkT0KJVSC7gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-09-21 03:15:03
(1 day ago)
Automated web scanning detected by Wazuh (rule 100240): repeated 400/404 errors from mass probing of ...
show more
Automated web scanning detected by Wazuh (rule 100240): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-09-21 03:15 UTC.
show less
Bad Web Bot
Web App Attack
🇩🇪
AetherFox
2026-09-21 02:44:24
(1 day ago)
AetherFox VoidGuard detected: [Mon Sep 21 02:44:23.041933 2026] [authz_core:error] [pid 3389095:tid ...
show more
AetherFox VoidGuard detected: [Mon Sep 21 02:44:23.041933 2026] [authz_core:error] [pid 3389095:tid 3389126] [client 34.24.144.114:53252] AH01630: client denied by server configuration: proxy:https://[MASKED]/
[Mon Sep 21 02:44:23.265132 2026] [authz_core:error] [pid 3389095:tid 3389102] [client 34.24.144.114:53252] AH01630: client denied by server configuration: proxy:https://[MASKED]/.git-credentials
[Mon Sep 21 02:44:23.368416 2026] [authz_core:error] [pid 3389095:tid 3389100] [client 34.24.144.114:53252] AH01630: client denied by server configuration: proxy:https://[MASKED]/src/.env
[Mon Sep 21 02:44:23.471350 2026] [authz_core:error] [pid 3389095:tid 3389119] [client 34.24.144.114:53252] AH01630: client denied by server configuration: proxy:https://[MASKED]/.git/config
[Mon Sep 21 02:44:23.474556 2026] [authz_core:error] [pid 3389095:tid 3389101] [client 34.24.144.114:53262] AH01630: client denied by server configuration: proxy:https://[MASKED]/.
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 02:43:39
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:43:33.560585 2026] [security2:error] [pid 10745:tid 10745] [client 34.24.144.114:53912] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||casadelsolmexico.net|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "casadelsolmexico.net"] [uri "/rclone.conf"] [unique_id "arCZ1T96WBuarPeeblz1BwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 02:11:58
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:11:51.751709 2026] [security2:error] [pid 12044:tid 12044] [client 34.24.144.114:53798] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lajoyadelmar.net"] [uri "/app/.env"] [unique_id "arCSZwbR0mMprAb-KBnCBQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 01:06:44
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:06:37.605885 2026] [security2:error] [pid 25811:tid 25811] [client 34.24.144.114:39310] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.shipdirect.net"] [uri "/.env_1"] [unique_id "arCDHY93P1ueVQBZTIVh7wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-09-21 01:02:35
(1 day ago)
csagent: score 20.0: secrets grab x2; 1 domain(s) in 0s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 00:23:44
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:23:39.121057 2026] [security2:error] [pid 14767:tid 14767] [client 34.24.144.114:40876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mjgraphics.net"] [uri "/.git/HEAD"] [unique_id "arB5C0K7lrvne3mqOL5rhgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ersei.net
2026-09-21 00:08:30
(1 day ago)
Web app exploiting
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:38:49
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.144.114 (114.144.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:38:44.976913 2026] [security2:error] [pid 3484646:tid 3484646] [client 34.24.144.114:53342] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.infinitynull.net"] [uri "/.env.local"] [unique_id "arBuhA-1zmBdUmwgPLqanAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
