2026-10-01 17:13:38
(2 weeks ago)
Portscan: TCP/8080 (3x), TCP/8443 (3x)
Port Scan
🇺🇸
TPI-Abuse
2026-10-01 15:19:54
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.39.158.224 (224.158.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.158.224 (224.158.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:19:46.109284 2026] [security2:error] [pid 24705:tid 24716] [client 34.39.158.224:52732] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||driftwoodblue.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "driftwoodblue.com"] [uri "/z9x8c7v6b5-debug-trigger-driftwoodblue.com"] [unique_id "ar56EoA_c8aNdCvGBTaelQAAAIk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 14:44:33
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.39.158.224 (224.158.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.158.224 (224.158.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:44:29.700622 2026] [security2:error] [pid 16630:tid 16630] [client 34.39.158.224:38218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.natural-history-conservation.com"] [uri "/.htpasswd"] [unique_id "ar5xzTrlT13kziV6lxdRmAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-01 14:07:03
(2 weeks ago)
Automated web scanner. Requested suspicious paths: /.vite/manifest.json | /dist/.vite/manifest.json ...
show more
Automated web scanner. Requested suspicious paths: /.vite/manifest.json | /dist/.vite/manifest.json | /dist/manifest.json | /build/manifest.json, /z9x8c7v6b5-debug-trigger-tigzig.com | /dist/.vite/manifest.json | /dist/manifest.json | /build/manifest.json. UTC: 2026-10-01 13:14:39.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 13:35:12
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.39.158.224 (224.158.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.158.224 (224.158.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:35:08.413114 2026] [security2:error] [pid 14545:tid 14545] [client 34.39.158.224:56768] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dunbeggan.com|F|2"] [data ".dunbeggan.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dunbeggan.com"] [uri "/z9x8c7v6b5-debug-trigger-www.dunbeggan.com"] [unique_id "ar5hjNR2rytxzrrqyJHLeAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-01 13:27:57
(2 weeks ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-01 13:27:10
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇳🇱
Alt255
2026-10-01 13:17:52
(2 weeks ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.39.158.224 - - [01/Oct/2026:15:17:51 +0200] "GET /.env.local?.svg?.wasm?init HTTP/2.0" 404 1920 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 13:13:09
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.39.158.224 (224.158.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.158.224 (224.158.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:13:05.354713 2026] [security2:error] [pid 11868:tid 11868] [client 34.39.158.224:58380] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.drowninglovers.com|F|2"] [data ".drowninglovers.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.drowninglovers.com"] [uri "/z9x8c7v6b5-debug-trigger-www.drowninglovers.com"] [unique_id "ar5cYb6hd9qBrMcw8U4h9gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-10-01 13:04:16
(2 weeks ago)
AutoBlock: 📡 Port Scan (Non Decay-Based) - ❌ Excessive 40X Errors (Decay-Based)
Port Scan
Bad Web Bot
🇫🇷
masterguru
2026-10-01 12:46:02
(2 weeks ago)
BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:User-Agent. (1100000 ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:User-Agent. (1100000-195)
show less
Bad Web Bot
2026-10-01 12:40:32
(2 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-10-01 12:36:33
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 12:32:24
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.39.158.224 (224.158.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.158.224 (224.158.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 08:32:21.759892 2026] [security2:error] [pid 23802:tid 23802] [client 34.39.158.224:40760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.bestprostate.com"] [uri "/files../.env"] [unique_id "ar5S1fXm0-mJS3IxFLUOoAAAAFw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
JPPO
2026-10-01 10:53:06
(2 weeks ago)
Multiport scan 4 ports : 80 443 8080 8443
Port Scan
