2026-10-11 12:36:27
(2 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 09:29:39
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 05:29:33.625400 2026] [security2:error] [pid 8766:tid 8766] [client 34.74.142.110:35268] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||app.oxfordgliding.com|F|2"] [data ".oxfordgliding.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "app.oxfordgliding.com"] [uri "/z9x8c7v6b5-debug-trigger-app.oxfordgliding.com"] [unique_id "astW_dS-HaldEEfZ1q833QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
1gz
2026-10-11 07:52:19
(2 days ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET met ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /.env_sample
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-10-11 05:54:17
(2 days ago)
malicious scanning tool activity
Web App Attack
🇫🇮
Christopher Hughes
2026-10-11 05:30:53
(2 days ago)
34.74.142.110 - - [11/Oct/2026:06:30:52 +0100] "GET /build/.env HTTP/2.0" 200 1455 "-" "Mozilla/5.0 ...
show more
34.74.142.110 - - [11/Oct/2026:06:30:52 +0100] "GET /build/.env HTTP/2.0" 200 1455 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 05:15:27
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 01:15:22.425708 2026] [security2:error] [pid 15676:tid 15676] [client 34.74.142.110:36262] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||weathercarib.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "weathercarib.com"] [uri "/z9x8c7v6b5-debug-trigger-weathercarib.com"] [unique_id "assbatPL0IKfi_vDK6OaNgAAADk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-11 05:05:09
(2 days ago)
9.046 requests from abuseipdb.com blacklisted IP (1w6d22h)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-11 04:53:35
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 00:53:30.468708 2026] [security2:error] [pid 11965:tid 11965] [client 34.74.142.110:48102] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wea-inc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wea-inc.com"] [uri "/z9x8c7v6b5-debug-trigger-wea-inc.com"] [unique_id "assWSmy5PTVDoKGRPkyFWQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-10-11 04:41:38
(2 days ago)
Attack against Apache (too many 404s)
Web App Attack
🇮🇪
tarlabs
2026-10-11 04:41:14
(2 days ago)
IP banned by Fail2Ban (traefik-404 jail)
Web App Attack
🇬🇧
consul.to
2026-10-11 04:39:48
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
EGP Abuse Dept
2026-10-11 04:36:17
(2 days ago)
Scanning for web/db/file exploits on www.wb-automation.com
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 04:28:48
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.74.142.110 (110.142.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 00:28:41.919423 2026] [security2:error] [pid 21610:tid 21610] [client 34.74.142.110:47932] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||waynejarvi.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "waynejarvi.com"] [uri "/z9x8c7v6b5-debug-trigger-waynejarvi.com"] [unique_id "assQeYJ6wPESyRESz4Y1PwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-11 04:23:46
(2 days ago)
Repeated exploit attempts, for example: /api/graphql {x22queryx22:x22{ __schema { types { name field ...
show more
Repeated exploit attempts, for example: /api/graphql {x22queryx22:x22{ __schema { types { name fields { name args { name defaultValue } } } } }x22} (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36")
show less
Web App Attack
🇩🇪
XICTRON
2026-10-11 04:05:03
(2 days ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
