🇬🇧
Celtic
2026-10-01 17:00:09
(2 weeks ago)
Blocked by Fail2Ban with Jail (plesk-modsecurity)
Brute-Force
SSH
2026-10-01 16:58:53
(2 weeks ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
2026-10-01 16:40:38
(2 weeks ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇳🇱
Site.eu
2026-10-01 16:35:04
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇮🇹
VHosting
2026-10-01 16:15:03
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇪🇸
masterguru
2026-10-01 16:10:23
(2 weeks ago)
BAD BOT - Detected and Blocked.. Matched phrase "baidu" at REQUEST_HEADERS:user-agent. (1100000-122)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-01 16:05:05
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 12:04:57.954126 2026] [security2:error] [pid 19160:tid 19160] [client 34.58.49.108:52616] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.major33.com"] [uri "/.htpasswd"] [unique_id "ar6EqQhujf549hN5ti-tAgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-10-01 15:56:57
(2 weeks ago)
34.58.49.108 - - [01/Oct/2026:15:11:37 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+ ...
show more
34.58.49.108 - - [01/Oct/2026:15:11:37 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 189 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:37 +0000] "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 189 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:37 +0000] "POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1" 404 189 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:37 +0000] "POST /cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1" 404 189 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:56:55 +000
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-01 15:26:44
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:26:36.490718 2026] [security2:error] [pid 15643:tid 15643] [client 34.58.49.108:33490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.natickvillagerentals.com"] [uri "/static../.env"] [unique_id "ar57rCI-lhkMCoOd_Gu44wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-10-01 15:11:32
(2 weeks ago)
34.58.49.108 - - [01/Oct/2026:15:11:25 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/ ...
show more
34.58.49.108 - - [01/Oct/2026:15:11:25 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:25 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:25 +0000] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:29 +0000] "GET /..%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.58.49.108"
34.58.49.108 - - [01/Oct/2026:15:11:29 +0000] "GET /%2e%2e/.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.58.49.108"
...
show less
Web Spam
Web App Attack
2026-10-01 14:33:35
(2 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 34.58.49.108 (US/United States/108.49.5 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.58.49.108 (US/United States/108.49.58.34.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-10-01 14:25:36
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:25:33.345208 2026] [security2:error] [pid 6907:tid 6907] [client 34.58.49.108:47138] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mentalmolecule.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mentalmolecule.com"] [uri "/z9x8c7v6b5-debug-trigger-mentalmolecule.com"] [unique_id "ar5tXSFTiCe78j9GI2c_4wAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-10-01 14:08:13
(2 weeks ago)
[ThuOct0116:08:10.3892202026][security2:error][pid3699936:tid3699947][client34.58.49.108:0]ModSecuri ...
show more
[ThuOct0116:08:10.3892202026][security2:error][pid3699936:tid3699947][client34.58.49.108:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:queryintrospectionquery\?\|__schema\\\\\\\\\?{\?\(\?:querytype\|types\?\)\)\?\\\\\\\\{\"atREQUEST_BODY.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"234\"][id\"344378\"][rev\"2\"][msg\"Atomicorp.comWAFRules:GraphQLInjectionAttackattempt\"][data\"MatchedData:__schema{types{foundwithinREQUEST_BODY:{\\\\x22query\\\\x22:\\\\x22{__schema{types{namefields{nameargs{namedefaultvalue}}}}}\\\\x22}\"][severity\"CRITICAL\"][tag\"SQLi\"][hostname\"leonitraslochi.ch\"][uri\"/graphql\"][unique_id\"ar5pSrwYqc93QjMjPixY6wAAAMk\"]\,referer:https://leonitraslochi.ch
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 13:58:08
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.49.108 (108.49.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:58:02.155047 2026] [security2:error] [pid 18262:tid 18262] [client 34.58.49.108:49050] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.mmailbox.com"] [uri "/.htpasswd"] [unique_id "ar5m6lih3l4EiwUhoTrDxgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-10-01 13:42:07
(2 weeks ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH