🇦🇺
iBlockBadBots
2026-10-05 10:00:20
(2 weeks ago)
WAF blocked multiple times in 24h. Paths: /api/graphql; /login; /config/gcp-credentials.json; /googl ...
show more
WAF blocked multiple times in 24h. Paths: /api/graphql; /login; /config/gcp-credentials.json; /google-service-account.json; /.env.example
show less
Bad Web Bot
Web App Attack
🇷🇸
pexodelic
2026-10-05 03:05:03
(2 weeks ago)
Automated report from web, SSH and FTP server logs: 56 requests probing for exposed secrets (.env, . ...
show more
Automated report from web, SSH and FTP server logs: 56 requests probing for exposed secrets (.env, .git, config files). First reported 2026-10-04 21:05 UTC, last reported 2026-10-05 05:05 UTC; counts cover the current log rotation window.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 22:01:59
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 18:01:54.125954 2026] [security2:error] [pid 28768:tid 28768] [client 34.40.17.116:59374] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lucid-events.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lucid-events.com"] [uri "/z9x8c7v6b5-debug-trigger-lucid-events.com"] [unique_id "asLM0q2G1BSqbl1Q-1PBdAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
london2038.com
2026-10-04 22:01:00
(2 weeks ago)
Malformed or malicious web request
34.40.17.116 - - [05/Oct/2026:00:00:57 +0200] "POST /lib/terminal ...
show more
Malformed or malicious web request
34.40.17.116 - - [05/Oct/2026:00:00:57 +0200] "POST /lib/terminal-xhr.php HTTP/2.0" 404 40040 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 21:39:31
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 17:39:24.543883 2026] [security2:error] [pid 27105:tid 27105] [client 34.40.17.116:37402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iacarbonell.com"] [uri "/.htpasswd"] [unique_id "asLHjMnN8_fdifbnpBzruQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-04 21:10:03
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇨🇭
dalslab ltd
2026-10-04 20:59:15
(2 weeks ago)
34.40.17.116 - - [04/Oct/2026:22:59:14 +0200] "POST / HTTP/1.1" 405 154 "-" "Mozilla/5.0 (compatible ...
show more
34.40.17.116 - - [04/Oct/2026:22:59:14 +0200] "POST / HTTP/1.1" 405 154 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.40.17.116 - - [04/Oct/2026:22:59:14 +0200] "POST /graphql HTTP/1.1" 405 556 "http://dalslab.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.40.17.116 - - [04/Oct/2026:22:59:15 +0200] "GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1" 400 154 "-" "-"
34.40.17.116 - - [04/Oct/2026:22:59:15 +0200] "POST /api/graphql HTTP/1.1" 405 556 "http://dalslab.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.40.17.116 - - [04/Oct/2026:22:59:15 +0200] "POST /v1/graphql HTTP/1.1" 405 556 "http://dalslab.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
...
show less
Web Spam
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 20:56:39
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 16:56:34.859477 2026] [security2:error] [pid 3178987:tid 3178989] [client 34.40.17.116:57260] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||credit-card-cap.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "credit-card-cap.com"] [uri "/z9x8c7v6b5-debug-trigger-credit-card-cap.com"] [unique_id "asK9ggj2Tke_5w7TnQdiowAAAUA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-04 20:39:51
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 20:19:12
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.40.17.116 (116.17.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 16:19:05.062964 2026] [security2:error] [pid 23057:tid 23057] [client 34.40.17.116:42922] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||alessiaalessandra.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alessiaalessandra.com"] [uri "/z9x8c7v6b5-debug-trigger-alessiaalessandra.com"] [unique_id "asK0uU-2pq7pT5_f8PiMgwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
wiredalter
2026-10-04 20:04:06
(2 weeks ago)
Blocked by fail2ban on gVPS [8080/tcp]
Source Port: 34392
TTL: 57
Packet Length: 60
TOS: 0x00
Analy ...
show more
Blocked by fail2ban on gVPS [8080/tcp]
Source Port: 34392
TTL: 57
Packet Length: 60
TOS: 0x00
Analyzed by https://ip.wiredalter.com
show less
Brute-Force
SSH
