🇻🇳
trung.fun
2026-06-10 01:01:38
(29 minutes ago)
DDoS, Hack, Brute Force, Web Attack
...
DDoS Attack
Web Spam
Hacking
Brute-Force
Web App Attack
🇺🇸
kbeezie
2026-06-10 00:54:08
(36 minutes ago)
34.40.59.232 - - [09/Jun/2026:20:54:07 -0400] "GET /configprops HTTP/1.1" 429 564 "-" "Mozilla/5.0 ( ...
show more
34.40.59.232 - - [09/Jun/2026:20:54:07 -0400] "GET /configprops HTTP/1.1" 429 564 "-" "Mozilla/5.0 (Linux; Android 7.1.2; FP2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3880.0 Mobile Safari/537.36"
34.40.59.232 - - [09/Jun/2026:20:54:07 -0400] "GET /heapdump HTTP/1.1" 429 162 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_4_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/8.0.57838 Mobile/12H321 Safari/600.1.4"
34.40.59.232 - - [09/Jun/2026:20:54:07 -0400] "GET /env HTTP/1.1" 429 564 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Safari/537.36"
34.40.59.232 - - [09/Jun/2026:20:54:07 -0400] "GET /trace HTTP/1.1" 429 162 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0"
34.40.59.232 - - [09/Jun/2026:20:54:07 -0400] "GET /api/actuator/heapdump HTTP/1.1" 429 564 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇫🇮
NoaQT
2026-06-10 00:07:05
(1 hour ago)
2026-06-10T00:07:05.050163+00:00 ingress-1 haproxy[2869]: 34.40.59.232:55416 [10/Jun/2026:00:07:05.0 ...
show more
2026-06-10T00:07:05.050163+00:00 ingress-1 haproxy[2869]: 34.40.59.232:55416 [10/Jun/2026:00:07:05.050] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 238/237/0/0/0 0/0 "GET /api/actuator/logfile HTTP/1.1"
2026-06-10T00:07:05.058261+00:00 ingress-1 haproxy[2869]: 34.40.59.232:55428 [10/Jun/2026:00:07:05.057] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 238/237/0/0/0 0/0 "GET /api/heapdump HTTP/1.1"
2026-06-10T00:07:05.062836+00:00 ingress-1 haproxy[2869]: 34.40.59.232:55440 [10/Jun/2026:00:07:05.062] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 235/234/0/0/0 0/0 "GET /api/env HTTP/1.1"
2026-06-10T00:07:05.070119+00:00 ingress-1 haproxy[2869]: 34.40.59.232:55446 [10/Jun/2026:00:07:05.069] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 234/233/0/0/0 0/0 "GET /api/configprops HTTP/1.1"
2026-06-10T00:07:05.076614+00:00 ingress-1 haproxy[2869]: 34.40.59.232:55458 [10/Jun/2026:00:07:05.076] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 2
...
show less
DDoS Attack
🇨🇭
backslash
2026-06-10 00:06:48
(1 hour ago)
block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68
Bad Web Bot
🇧🇪
cmbplf
2026-06-10 00:02:49
(1 hour ago)
2.063 requests from abuseipdb.com blacklisted IP (10mos4w1d)
Brute-Force
Bad Web Bot
2026-06-09 23:22:28
(2 hours ago)
34.40.59.232 - - [10/Jun/2026:01:22:26 +0200] "GET /actuator/heapdump HTTP/1.1" 403 7941 "-" "Mozill ...
show more
34.40.59.232 - - [10/Jun/2026:01:22:26 +0200] "GET /actuator/heapdump HTTP/1.1" 403 7941 "-" "Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10"
34.40.59.232 - - [10/Jun/2026:01:22:26 +0200] "GET /actuator/env HTTP/1.1" 403 7941 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36"
34.40.59.232 - - [10/Jun/2026:01:22:26 +0200] "GET /actuator/configprops HTTP/1.1" 403 7941 "-" "Mozilla/5.0 (X11; U; OpenBSD i386; en-US; rv:1.9.1) Gecko/20090702 Firefox/3.5"
34.40.59.232 - - [10/Jun/2026:01:22:26 +0200] "GET /actuator/threaddump HTTP/1.1" 403 7941 "-" "SonyEricssonW850i/R1ED Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1"
34.40.59.232 - - [10/Jun/2026:01:22:26 +0200] "GET /actuator/logfile HTTP/1.1" 403 7941 "-" "Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mob
...
show less
DDoS Attack
🇳🇱
Savvii
2026-06-09 20:47:39
(4 hours ago)
20 attempts against mh-misbehave-ban on choy
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 19:20:33
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 15:20:28.071243 2026] [security2:error] [pid 27843:tid 27843] [client 34.40.59.232:57106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/parameters.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.angelaknightmusic.com"] [uri "/app/config/parameters.yml"] [unique_id "aihnfOrEIDmYa37YoN07mwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 18:20:13
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 14:20:09.724577 2026] [security2:error] [pid 14508:tid 14508] [client 34.40.59.232:60172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.willyouanswerthecall.com"] [uri "/config/config.yml"] [unique_id "aihZWbPaj0_E_MnnPstmpwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-06-09 16:42:38
(8 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 13:31:58
(11 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 09:31:53.359210 2026] [security2:error] [pid 3563:tid 3563] [client 34.40.59.232:60166] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.sympalais.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.sympalais.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aigVyTfEZ00kbXH5oGGGdgAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-09 12:58:36
(12 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 10:45:52
(14 hours ago)
(mod_security) mod_security (id:210831) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210831) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 06:45:45.532770 2026] [security2:error] [pid 25932:tid 25932] [client 34.40.59.232:51890] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||sigiweb.net|F|4"] [data "Microsoft URL"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "sigiweb.net"] [uri "/app/actuator/heapdump"] [unique_id "aifu2bXVyHJh3h4bShROXQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
curiosity
2026-06-09 09:51:55
(15 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-09 09:51:13
(15 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.40.59.232 (232.59.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 05:51:08.010667 2026] [security2:error] [pid 17521:tid 17538] [client 34.40.59.232:35766] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.smarterproductions.teritemme.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.smarterproductions.teritemme.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aifiC7B1dKA0pBpgdlo0VgAAAIw"]
show less
Brute-Force
Bad Web Bot
Web App Attack