🇳🇱
homeshowdomain.nl
2026-09-30 22:01:36
(2 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-29.
show less
Web App Attack
SSH
Hacking
🇩🇪
Hazzard
2026-09-30 04:13:45
(2 weeks ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇺🇸
TPI-Abuse
2026-09-30 04:09:34
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:09:29.490811 2026] [security2:error] [pid 28042:tid 28042] [client 34.70.207.21:46050] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||katharinanitzpon.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "katharinanitzpon.com"] [uri "/z9x8c7v6b5-debug-trigger-katharinanitzpon.com"] [unique_id "aryLeTpqZtaLM8bAIxwNOgAAAHA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-09-30 03:49:05
(2 weeks ago)
34.70.207.21 - - [30/Sep/2026:03:48:58 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env ...
show more
34.70.207.21 - - [30/Sep/2026:03:48:58 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [30/Sep/2026:03:48:58 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [30/Sep/2026:03:48:58 +0000] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [30/Sep/2026:03:48:58 +0000] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [30/Sep/2026:03:49:03 +0000] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
...
show less
Web Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:54:39
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:54:35.691093 2026] [security2:error] [pid 31039:tid 31039] [client 34.70.207.21:42580] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||keystonebrass.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystonebrass.com"] [uri "/z9x8c7v6b5-debug-trigger-keystonebrass.com"] [unique_id "arxr24WeKtPfHhvbGgi_-AAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:34:56
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:34:49.248101 2026] [security2:error] [pid 21114:tid 21114] [client 34.70.207.21:57054] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||kellymalone.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kellymalone.com"] [uri "/z9x8c7v6b5-debug-trigger-kellymalone.com"] [unique_id "arxnOYaiCmzKD7JasOWOYwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Lee Daniel
2026-09-30 01:21:19
(2 weeks ago)
34.70.207.21 - - [29/Sep/2026:21:21:19 -0400] "GET /.htpasswd HTTP/1.1" 403 6276 "-" "Mozilla/5.0 (c ...
show more
34.70.207.21 - - [29/Sep/2026:21:21:19 -0400] "GET /.htpasswd HTTP/1.1" 403 6276 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
...
show less
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:12:31
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:12:26.107274 2026] [security2:error] [pid 29819:tid 29819] [client 34.70.207.21:33438] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kinnaird.enterprises"] [uri "/.env"] [unique_id "arxh-pAVPStO5xQsFx-6kwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-30 01:03:41
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
andypiper
2026-09-30 01:03:14
(2 weeks ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 00:28:30
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 20:28:26.297932 2026] [security2:error] [pid 7147:tid 7170] [client 34.70.207.21:54620] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kiwimagic.net"] [uri "/app/.env"] [unique_id "arxXqmJLoUnRVIHkJwOUmgAAAIk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 00:10:36
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.70.207.21 (21.207.70.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 20:10:33.404967 2026] [security2:error] [pid 2444:tid 2462] [client 34.70.207.21:55910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kaukabsiddique.net"] [uri "/.env.bak"] [unique_id "arxTefVQTnmflSwlQ5c-TgAAARA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-29 23:51:44
(2 weeks ago)
104 requests with url.path *config.json
Brute-Force
Bad Web Bot
🇧🇪
cmbplf
2026-09-29 23:29:03
(2 weeks ago)
3.217 requests from abuseipdb.com blacklisted IP (1mo3d15h)
Brute-Force
Bad Web Bot
🇪🇸
robotstxt
2026-09-29 23:24:33
(2 weeks ago)
34.70.207.21 - - [29/Sep/2026:23:24:30 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env HTTP/1.1" 400 1 ...
show more
34.70.207.21 - - [29/Sep/2026:23:24:30 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [29/Sep/2026:23:24:30 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [29/Sep/2026:23:24:30 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [29/Sep/2026:23:24:30 +0000] "GET /public/plugins/alertlist/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
34.70.207.21 - - [29/Sep/2026:23:24:30 +0000] "GET /public/plugins/alertlist/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.70.207.21"
...
show less
Web Spam
Web App Attack