2026-05-27 20:05:07
(1 week ago)
DNS Compromise
DDoS Attack
🇺🇸
TPI-Abuse
2026-05-27 18:22:19
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.64.162.97 (97.162.64.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.64.162.97 (97.162.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 14:22:12.454547 2026] [security2:error] [pid 15554:tid 15554] [client 34.64.162.97:52956] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.geofreightint.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.geofreightint.com"] [uri "/backup.sql"] [unique_id "ahc2VM_blp5IW3rRwCcmIgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
XICTRON
2026-05-27 15:50:05
(1 week ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
2026-05-27 13:09:57
(1 week ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 11:49:32
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.64.162.97 (97.162.64.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.64.162.97 (97.162.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 07:49:25.868644 2026] [security2:error] [pid 29466:tid 29480] [client 34.64.162.97:37624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.andyboynton.com"] [uri "/config/config.yml"] [unique_id "ahbaRZTo37TXNDmKLrrXPwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-05-27 07:26:26
(1 week ago)
20 attempts against mh-misbehave-ban on ec102966
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-05-27 05:29:30
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 04:27:44
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.64.162.97 (97.162.64.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.64.162.97 (97.162.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 00:27:39.760978 2026] [security2:error] [pid 15043:tid 15078] [client 34.64.162.97:48262] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.fevini.com"] [uri "/config/config.yml"] [unique_id "ahZyu0FYeuQCD7KP2RnA-QAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-05-27 02:40:19
(1 week ago)
Attempted access to sensitive endpoint (/config/aws.json) detected. Automated scan or unauthorized p ...
show more
Attempted access to sensitive endpoint (/config/aws.json) detected. Automated scan or unauthorized probing.
show less
Web App Attack
2026-05-27 02:05:45
(1 week ago)
WAF repeated trigger detected by Fail2Ban
Web App Attack
2026-05-27 02:00:09
(1 week ago)
| [Dangerous/South Korea] Aggressive IP 34.64.162.97 (~30 hits). Type: DoS Defender- Web server 400 ...
show more
| [Dangerous/South Korea] Aggressive IP 34.64.162.97 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Web App Attack
Hacking
SQL Injection
🇳🇱
ConsulHosting
2026-05-27 01:15:25
(1 week ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇩🇪
4server
2026-05-26 23:46:24
(1 week ago)
[WedMay2701:46:22.2213362026][security2:error][pid2235634:tid2235704][client34.64.162.97:0]ModSecuri ...
show more
[WedMay2701:46:22.2213362026][security2:error][pid2235634:tid2235704][client34.64.162.97:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"webmail.miotrentino.it\"][uri\"/backup.sql\"][unique_id\"ahYwzo7g-7hhbXmuQJZbjAAAAIg\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-05-26 23:00:09
(1 week ago)
SPAM - Bruteforce Attack - DDOS 2
Email Spam
Brute-Force
🇮🇹
VHosting
2026-05-26 22:45:03
(1 week ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack