🇮🇳
evicky2002
2026-05-02 06:00:00
UTC ·
(6 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇫🇷
masterguru
2026-05-01 06:59:15
UTC ·
(6 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.6.33.93 (NL/The Netherlands/93.33.6.34.bc.googleusercontent.com): 2 in the last 3600 secs (0-193)
Hacking
🇩🇪
LRob
2026-05-01 06:30:03
UTC ·
(6 months ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-01 06:05:44
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 34.6.33.93 (93.33.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 02:05:39.565862 2026] [security2:error] [pid 15031:tid 15031] ...
show more
(mod_security) mod_security (id:210730) triggered by 34.6.33.93 (93.33.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 02:05:39.565862 2026] [security2:error] [pid 15031:tid 15031] [client 34.6.33.93:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.distro.media|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.distro.media"] [uri "/.config/gcloud/credentials.db"] [unique_id "afRCs6Pnsa2w0QXiJMzDVwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 04:17:51
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.6.33.93 (93.33.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 00:17:48.173620 2026] [security2:error] [pid 28344:tid 28344] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.6.33.93 (93.33.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 00:17:48.173620 2026] [security2:error] [pid 28344:tid 28344] [client 34.6.33.93:45568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.erkan.net"] [uri "/wp-config.php.bak"] [unique_id "afQpbNJeJoa5oe0t0PPinwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 03:44:47
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 34.6.33.93 (93.33.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 23:44:39.850276 2026] [security2:error] [pid 4564:tid 4665] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 34.6.33.93 (93.33.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 23:44:39.850276 2026] [security2:error] [pid 4564:tid 4665] [client 34.6.33.93:47384] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||busybeerestaurant.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "busybeerestaurant.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "afQhpwTWNFfMXrehw7JSPQAAAgQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Little Iguana
2026-05-01 03:43:49
UTC ·
(6 months ago)
Attempt to hack Wordpress Login, XMLRPC or other login
Hacking
🇺🇸
ambor
2026-05-01 03:34:56
UTC ·
(6 months ago)
Honeypot triggered: /actuator/env on ifebridge.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/76.0.3809.87 Chrome/76.0.3809.87 Safari/537.36. Method: GET
Web App Attack
🇺🇦
URAN Publishing Service
2026-05-01 00:19:07
UTC ·
(6 months ago)
34.6.33.93 - - [01/May/2026:03:19:06 +0300] "GET /wp-config.php~ HTTP/1.1" 404 3297 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36"
34.6.33.93 - - [01/May/2026:03:19:06 +0300] "GET ...
show more
34.6.33.93 - - [01/May/2026:03:19:06 +0300] "GET /wp-config.php~ HTTP/1.1" 404 3297 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36"
34.6.33.93 - - [01/May/2026:03:19:06 +0300] "GET /wp-config.php.bak HTTP/1.1" 404 3296 "-" "Mozilla/5.0 (webOS/1.3; U; en-US) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/1.0 Safari/525.27.1 Desktop/1.0"
...
show less
Web App Attack
🇬🇧
consul.to
2026-05-01 00:18:20
UTC ·
(6 months ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
4server
2026-04-30 22:47:08
UTC ·
(6 months ago)
[FriMay0100:47:04.2890902026][security2:error][pid3581079:tid3581084][client34.6.33.93:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess ...
show more
[FriMay0100:47:04.2890902026][security2:error][pid3581079:tid3581084][client34.6.33.93:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpanel.serban.ch\"][uri\"/wp-config.php.bak\"][unique_id\"afPb6NmQUzTi1XbmU2lVpwAAAEI\"]
show less
Port Scan
Brute-Force
Web App Attack
🇮🇹
alph44
2026-04-30 21:01:12
UTC ·
(6 months ago)
(mod_security) mod_security (id:949110) triggered by 34.6.33.93 (NL/The Netherlands/93.33.6.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs:
Web App Attack
🇩🇪
Fnek
2026-04-30 20:15:01
UTC ·
(6 months ago)
crowdsecurity/http-crawl-non_statics - 202604302215
Hacking
🇲🇾
Rizzy
2026-04-30 18:31:14
UTC ·
(6 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇮🇹
clamehost.it
2026-04-30 18:04:56
UTC ·
(6 months ago)
Automatic report - Brute Force attack using this IP address
Brute-Force