🇲🇾
Rizzy
2026-09-14 12:24:05
(4 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇿
Antinson
2026-09-13 13:35:18
(1 month ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇳🇱
Site.eu
2026-09-13 07:49:02
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
consul.to
2026-09-13 06:29:16
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TAY
2026-09-13 05:44:56
(1 month ago)
34.26.193.13 - - [13/Sep/2026:13:44:54 +0800] "GET /api/w/starter/jobs_u/get_log_file/../../../../pr ...
show more
34.26.193.13 - - [13/Sep/2026:13:44:54 +0800] "GET /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ HTTP/1.1" 404 7813 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
34.26.193.13 - - [13/Sep/2026:13:44:54 +0800] "GET /appearance/../../.env HTTP/1.1" 400 2057 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
34.26.193.13 - - [13/Sep/2026:13:44:54 +0800] "GET /appearance/../../proc/self/environ HTTP/1.1" 400 2057 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.26.193.13 - - [13/Sep/2026:13:44:55 +0800] "GET /public/plugins/alertlist/../../../../../../../../proc/self/cmdline HTTP/1.1" 400 2057 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)"
34.26.193.13 - - [13/Sep/2026:13:44:55 +0800] "GET /@fs/../.env?import&raw?? HTTP/1.1" 404 2050 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
34.26.193.13
...
show less
Brute-Force
🇲🇾
Rizzy
2026-09-13 05:23:48
(1 month ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 04:16:00
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.26.193.13 (13.193.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.26.193.13 (13.193.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 00:15:51.971341 2026] [security2:error] [pid 29617:tid 29617] [client 34.26.193.13:53570] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||email.ryanpianos.com|F|2"] [data ".ryanpianos.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "email.ryanpianos.com"] [uri "/z9x8c7v6b5-debug-trigger-email.ryanpianos.com"] [unique_id "aqTR93UON7T7KSaO0MOO5AAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-11 19:37:12
(1 month ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Site.eu
2026-09-11 19:30:22
(1 month ago)
Excessive 404/403 errors
Brute-Force
🇵🇱
strefapi_com
2026-09-11 19:08:51
(1 month ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 18:59:40
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.26.193.13 (13.193.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.26.193.13 (13.193.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 14:59:33.963556 2026] [security2:error] [pid 26830:tid 26830] [client 34.26.193.13:55252] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sabbathschoolguide.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sabbathschoolguide.com"] [uri "/z9x8c7v6b5-debug-trigger-sabbathschoolguide.com"] [unique_id "aqRPlUxAj201vzv8ZtwHcwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-09-11 18:03:52
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.26.193.13 (US/Uni ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.26.193.13 (US/United States/13.193.26.34.bc.googleusercontent.com)
show less
Bad Web Bot
🇳🇱
WeCloudit-Anti-Abuse
2026-09-11 18:03:19
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-11 17:43:55
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.26.193.13 (13.193.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.26.193.13 (13.193.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 13:43:49.423322 2026] [security2:error] [pid 3108:tid 3108] [client 34.26.193.13:57804] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ryszardwycisk.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ryszardwycisk.com"] [uri "/z9x8c7v6b5-debug-trigger-ryszardwycisk.com"] [unique_id "aqQ91Sd1BzEinuCy2qyXNwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-11 17:18:46
(1 month ago)
fail2ban:piguard2:18,19,21
Brute-Force
Bad Web Bot
Web App Attack
