🇩🇪
LRob
2026-10-13 18:28:58
(4 days ago)
Secret file probe | method: GET | path: /.git/config | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebK ...
show more
Secret file probe | method: GET | path: /.git/config | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 15:40:37
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 11:40:29.788489 2026] [security2:error] [pid 25758:tid 25758] [client 34.39.249.92:48018] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mystudioinparis.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mystudioinparis.com"] [uri "/z9x8c7v6b5-debug-trigger-mystudioinparis.com"] [unique_id "asut7VM9bTcsVSscFYsLAgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 15:20:33
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 11:20:29.691446 2026] [security2:error] [pid 3085:tid 3085] [client 34.39.249.92:36074] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||myrtlebeachpartybuses.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "myrtlebeachpartybuses.com"] [uri "/z9x8c7v6b5-debug-trigger-myrtlebeachpartybuses.com"] [unique_id "asupPb6d9RZWTSzwtOdf-gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 05:48:11
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 01:48:03.361972 2026] [security2:error] [pid 16921:tid 16921] [client 34.39.249.92:37044] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mykelmilur.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mykelmilur.com"] [uri "/z9x8c7v6b5-debug-trigger-mykelmilur.com"] [unique_id "assjE4jWEtfbIa9V8YeS6QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-11 05:25:26
(1 week ago)
1.851 requests with url.path *.env
770 requests with url.path */@fs/*
175 requests with url.path ...
show more
1.851 requests with url.path *.env
770 requests with url.path */@fs/*
175 requests with url.path *.aws/*
173 requests with url.path *credentials.json
127 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
🇳🇱
e.fierstra
2026-10-11 01:53:09
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:26:19
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:26:16.472829 2026] [security2:error] [pid 15246:tid 15246] [client 34.39.249.92:50472] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||n4ocw.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "n4ocw.com"] [uri "/z9x8c7v6b5-debug-trigger-n4ocw.com"] [unique_id "asrluCAJQXRvRyo34E7JKAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:05:48
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:05:42.695242 2026] [security2:error] [pid 30913:tid 30913] [client 34.39.249.92:42046] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||myuscpa.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "myuscpa.com"] [uri "/z9x8c7v6b5-debug-trigger-myuscpa.com"] [unique_id "asrg5o6HqmgFJuB_VA5LwgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-10-11 01:03:13
(1 week ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-10-11 00:54:48
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-11 00:47:01
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 20:46:56.193358 2026] [security2:error] [pid 10430:tid 10430] [client 34.39.249.92:55212] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mysticalparadise.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mysticalparadise.com"] [uri "/z9x8c7v6b5-debug-trigger-mysticalparadise.com"] [unique_id "asrcgFYDDKSu7cF6nWGOXAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-10-11 00:37:29
(1 week ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB repu ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB reputation policy (no URL signature). Evidence: Suspicion-Ban (Score 85>=65, Abuse 100, NonEU, first-seen)
show less
Hacking
Exploited Host
Web App Attack
2026-10-11 00:30:12
(1 week ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-10-11 00:10:30
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.249.92 (92.249.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 20:10:25.661401 2026] [security2:error] [pid 21962:tid 21962] [client 34.39.249.92:51060] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mypensees.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mypensees.com"] [uri "/z9x8c7v6b5-debug-trigger-mypensees.com"] [unique_id "asrT8atZugoy9P6-OewN1wAAADQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-10-11 00:04:27
(1 week ago)
Accessed trap at '/.env'
Web App Attack
