🇺🇸
TPI-Abuse
2026-09-07 03:06:29
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 23:06:22.805177 2026] [security2:error] [pid 27856:tid 27856] [client 34.55.185.80:36538] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chassell.info"] [uri "/.git/HEAD"] [unique_id "ap4qLu-6HIrqRMnas2CDkwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 02:17:56
(3 hours ago)
(mod_security) mod_security (id:210580) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210580) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 22:17:48.593458 2026] [security2:error] [pid 7149:tid 7149] [client 34.55.185.80:43298] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||www.gescosigns.com|F|2"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "www.gescosigns.com"] [uri "/api/fs/read"] [unique_id "ap4ezNexGrFg9GygjcUyjwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 01:31:49
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 21:31:44.338899 2026] [security2:error] [pid 1837:tid 1837] [client 34.55.185.80:44942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tytiannasanderson.com"] [uri "/api/.env"] [unique_id "ap4UAKnPnSRVPv7kDTgzqAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-09-07 00:28:02
(4 hours ago)
Too many 404 requests [BY]
Web App Attack
🇳🇱
ConsulHosting
2026-09-07 00:22:51
(5 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 23:59:56
(5 hours ago)
(mod_security) mod_security (id:210580) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210580) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 19:59:50.024269 2026] [security2:error] [pid 21379:tid 21379] [client 34.55.185.80:57680] ModSecurity: Access denied with code 403 (phase 2). Matched phrase ".ssh/id_rsa" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||readyaiminspire.com|F|2"] [data "Matched Data: .ssh/id_rsa found within ARGS:filename: file:/root/.ssh/id_rsa"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "readyaiminspire.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "ap3-dscDdApXbzgbkyklgQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
naveeddaros
2026-09-06 23:02:54
(6 hours ago)
HTTP Flood DDoS attack detected
Brute-Force
Bad Web Bot
🇳🇱
Site.eu
2026-09-06 23:02:46
(6 hours ago)
Excessive multi-domain requests
Brute-Force
🇨🇭
zynex
2026-09-06 22:21:39
(7 hours ago)
URL Probing: /.env
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-06 21:53:18
(7 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
2026-09-06 21:35:28
(7 hours ago)
34.55.185.80 - - [07/Sep/2026:05:35:26 +0800] "GET /rclone.conf HTTP/1.1" 404 13837 "https://www.ide ...
show more
34.55.185.80 - - [07/Sep/2026:05:35:26 +0800] "GET /rclone.conf HTTP/1.1" 404 13837 "https://www.ideo.hk/rclone.conf" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.55.185.80 - - [07/Sep/2026:05:35:26 +0800] "GET /graphql HTTP/1.1" 404 13841 "https://www.ideo.hk" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 EdgA/151.0.0.0"
34.55.185.80 - - [07/Sep/2026:05:35:26 +0800] "GET /graphql HTTP/1.1" 404 13841 "https://www.ideo.hk" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 EdgA/151.0.0.0"
34.55.185.80 - - [07/Sep/2026:05:35:27 +0800] "GET /service-account.json HTTP/1.1" 404 13837 "https://www.ideo.hk/service-account.json" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
34.55.185.80 - - [07/Sep/2026:05:35:27 +0800] "GET /service-account.json HTTP/1.1" 404 13837 "https://www.ideo.hk/service-account.json" "Mo
...
show less
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-06 20:42:29
(8 hours ago)
370 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-06 20:40:49
(8 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:949110) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 16:40:42.075631 2026] [security2:error] [pid 14395:tid 14395] [client 34.55.185.80:42220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "quailmesa.com"] [uri "/z9x8c7v6b5-debug-trigger-quailmesa.com"] [unique_id "ap3PymonGItqWxxsOkr39AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 19:41:03
(9 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.55.185.80 (80.185.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 15:40:57.092603 2026] [security2:error] [pid 12816:tid 12816] [client 34.55.185.80:58746] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nnrentacar.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nnrentacar.com"] [uri "/rclone.conf"] [unique_id "ap3ByUjr1-_yu1lqdjFJcAAAAEg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-06 19:24:10
(10 hours ago)
20 attempts against mh_ha-misbehave-ban on ceres
Brute-Force
Bad Web Bot
Web App Attack
