Anonymous
2026-06-14 13:06:52
(1 week ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: KR, Attack patterns: Word ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: KR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
show less
Bad Web Bot
Web App Attack
๐ณ๐ฑ
homeshowdomain.nl
2026-06-13 22:08:21
(1 week ago)
Auto-ban: >3000 req/min op 2026-06-13
Web App Attack
SSH
Hacking
Anonymous
2026-06-13 12:04:38
(1 week ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: KR, Attack patterns: Word ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: KR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-06-13 10:36:43
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.47.77.16 (16.77.47.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.47.77.16 (16.77.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 06:36:37.168690 2026] [security2:error] [pid 3110:tid 3110] [client 34.47.77.16:57072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "assembliesofgodinsamoa.org.nomanszone.org"] [uri "/wp-config.php~"] [unique_id "ai0ytX8RzfOGGYoWC9qhVAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
dynamix
2026-06-13 09:16:34
(1 week ago)
Multiple WAF Violations
Web App Attack
๐ซ๐ฎ
Mausteuuno
2026-06-13 05:31:00
(1 week ago)
Scans for credentials
34.47.77.16 - - [13/Jun/2026:08:31:39 +0300] "GET /.config/gcloud/credentials ...
show more
Scans for credentials
34.47.77.16 - - [13/Jun/2026:08:31:39 +0300] "GET /.config/gcloud/credentials.db HTTP/1.1" 404 4 "-" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/51.0.2704.79 Chrome/51.0.2704.79 Safari/537.36"
34.47.77.16 - - [13/Jun/2026:08:31:39 +0300] "GET /actuator/env HTTP/1.1" 500 4 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36"
34.47.77.16 - - [13/Jun/2026:08:31:39 +0300] "GET /.azure/credentials HTTP/1.1" 500 4 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36"
34.47.77.16 - - [13/Jun/2026:08:31:39 +0300] "GET /credentials HTTP/1.1" 500 4 "-" "Mozilla/5.0 (Linux; Android 8.0.0; SM-T820) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Safari/537.36"
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-06-13 04:15:28
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.47.77.16 (16.77.47.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.47.77.16 (16.77.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 00:15:21.054711 2026] [security2:error] [pid 1120:tid 1120] [client 34.47.77.16:60448] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||controvac.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "controvac.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aizZWd3zNgJUfA8J8-ZFdQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
Octopuce
2026-06-13 04:09:13
(1 week ago)
Aggressive web search of vulnerable pages: /sql/backup.sql /www.zip /web.zip /sql/dump.sql /applicat ...
show more
Aggressive web search of vulnerable pages: /sql/backup.sql /www.zip /web.zip /sql/dump.sql /application.yml ...
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-06-13 04:00:14
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.47.77.16 (16.77.47.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.47.77.16 (16.77.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 00:00:09.833427 2026] [security2:error] [pid 7579:tid 7590] [client 34.47.77.16:56056] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.atechtransmission.ceol.us|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.atechtransmission.ceol.us"] [uri "/.config/gcloud/credentials.db"] [unique_id "aizVyb1IlqGZ-ShJjFBWYwAAAEg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Cloud86 B.V.
2026-06-13 03:52:03
(1 week ago)
categories: DDoS Attack
DDoS Attack
๐ณ๐ฑ
Savvii
2026-06-13 03:18:35
(1 week ago)
15 attempts against mh-modsecurity-ban on hostbillst4
Brute-Force
Web App Attack