🇺🇸
TPI-Abuse
2026-09-21 19:45:41
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.60.86.18 (18.86.60.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.60.86.18 (18.86.60.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 15:45:36.041161 2026] [security2:error] [pid 20128:tid 20128] [client 34.60.86.18:36336] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.1derfulwaysrv.com"] [uri "/.env.example"] [unique_id "arGJYNZvS6I_ZYG0iug8DQAAAFk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-21 16:20:18
(3 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-21 16:14:41
(3 weeks ago)
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /api/.env/public/.env HTTP/2.0" 404 62333 "-" "Moz ...
show more
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /api/.env/public/.env HTTP/2.0" 404 62333 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /api/v1/settings HTTP/2.0" 403 293 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email])"
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /..%2f.env HTTP/2.0" 404 289 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /api/config HTTP/2.0" 404 62333 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /api/settings HTTP/2.0" 404 62333 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
34.60.86.18 - - [21/Sep/2026:18:14:39 +0200] "GET /%2e%2e/.env HTTP/2.0" 400 319 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
3
show less
Web App Attack
Hacking
🇩🇰
HostingGroup
2026-09-21 15:36:53
(3 weeks ago)
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shiel ...
show more
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 7. First blocked: 2026-09-21.
show less
Bad Web Bot
Web App Attack
🇹🇭
thaizone.com
2026-09-21 15:36:30
(3 weeks ago)
Brute Force Attack on a Web Resources (repeated 404) #1
DDoS Attack
Web Spam
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 14:29:23
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.60.86.18 (18.86.60.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.60.86.18 (18.86.60.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 10:29:18.851529 2026] [security2:error] [pid 23562:tid 23562] [client 34.60.86.18:59930] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||waggonerfinancial.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "waggonerfinancial.com"] [uri "/z9x8c7v6b5-debug-trigger-waggonerfinancial.com"] [unique_id "arE_Pm9EBy1sMecHhNL6qwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 13:42:17
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.60.86.18 (18.86.60.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.60.86.18 (18.86.60.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 09:42:10.464092 2026] [security2:error] [pid 7962:tid 7962] [client 34.60.86.18:50842] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||1writeforthegrant.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "1writeforthegrant.com"] [uri "/z9x8c7v6b5-debug-trigger-1writeforthegrant.com"] [unique_id "arE0Mgm53M_i_oN2sPEvcAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
noise.agency
2026-09-21 12:14:17
(3 weeks ago)
34.60.86.18 (US/United States/18.86.60.34.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇫🇷
dynamix
2026-09-21 11:41:15
(3 weeks ago)
Multiple WAF Violations
Web App Attack
2026-09-21 11:30:07
(3 weeks ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection